<p>i've been smashing my head agains this issue, i don't know if it's a bug or just misconfiguration. The situation i have is the following: </p>

<p>Inside my cluster, i have the namespace "testing", which has 2 deployments:</p>

<ol>
<li>Front-end</li>
<li>Back-end</li>
</ol>

<p>Services:</p>

<ol>
<li>front-end-service.local</li>
<li>back-end-service.local</li>
</ol>

<p>Both have their services working properly and an ALB is configured to be accessed from the browser. </p>

<ol>
<li><a href="https://front.example.com" rel="nofollow noreferrer">https://front.example.com</a></li>
<li><a href="https://back.example.com" rel="nofollow noreferrer">https://back.example.com</a></li>
</ol>

<p>Inside the cluster, from the front end, i can point the backend with a variable to <a href="https://back.example.com" rel="nofollow noreferrer">https://back.example.com</a>, and everything works as expected. </p>

<p>However, i was asked to make that communication INSIDE the cluster, so my first attempt was pointing this time to the backend service from the front-end.</p>

<p>Tried to point at: <a href="https://back-end-service.local" rel="nofollow noreferrer">https://back-end-service.local</a> and received this error:</p>

<p><strong><em>Reason: CORS request did not succeed</em></strong></p>

<p>Guessing it was because of TLS, i deployed Istio in the namespace, with mutual TLS enabled in STRICT mode. After opening Kiali, i do see the encrypted communication working, however, still i get the same error. </p>

<p>Testing i did: </p>

<p>If i log into the Front-End pod and try to make a curl <a href="https://back.example.com" rel="nofollow noreferrer">https://back.example.com</a>, i get a positive response from my API.</p>

<p>If i do a curl <a href="https://back-end-service.local" rel="nofollow noreferrer">https://back-end-service.local</a>, i get curl: (35) SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol.</p>

<p>So in brief, i can communicate to my back-end going outside the cluster and then going back in but if i try to communicate between services INSIDE, it fails with CORS and SSL error. </p>

<p>My config:</p>

<pre><code>kind: PeerAuthentication
apiVersion: security.istio.io/v1beta1
metadata:
  name: default
  namespace: testing
  selfLink: &gt;-
    /apis/security.istio.io/v1beta1/namespaces/production/peerauthentications/default     
  resourceVersion: '7291'
  generation: 1
  creationTimestamp: '2020-06-06T00:22:24Z'
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: &gt;
      {"apiVersion":"security.istio.io/v1beta1","kind":"PeerAuthentication","metadata":{"annotations":{},"name":"default","namespace":"testing"},"spec":{"mtls":{"mode":"STRICT"}}}
spec:
  selector: ~
  mtls:
    mode: STRICT
  portLevelMtls: ~
</code></pre>

<p>Back-End-Service:</p>

<pre><code>kind: Service
apiVersion: v1
metadata:
  name: back-end-service
  namespace: testing
  selfLink: /api/v1/namespaces/testing/services/back-end-service
  uid: dccf1b
  resourceVersion: '7520501'
  creationTimestamp: '2020-05-14T21:48:54Z'
  labels:
    app: back-end
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: &gt;
      {"apiVersion":"v1","kind":"Service","metadata":{"annotations":{},"labels":{"app":"back-end"},"name":"back-end-service","namespace":"testing"},"spec":{"ports":[{"name":"http","port":3001,"targetPort":3001}],"selector":{"app":"back-end"}}}
  finalizers:
    - service.kubernetes.io/load-balancer-cleanup
spec:
  ports:
    - name: https
      protocol: TCP
      port: 3001
      targetPort: 3001
      nodePort: 30742
  selector:
    app: back-end
  clusterIP: 192.168.1.1
  type: LoadBalancer
  sessionAffinity: None
  externalTrafficPolicy: Cluster
</code></pre>

<p>I've tried to change the name to HTTP and HTTPS to the services but it goes beyond that. Any help would be appreciate it! </p>

WifiWolf
<p>Can you try using the port 3001 in place of port 443? There is no https probably on port 443 and so the SSL Error.</p>
