<p>I created a node js TLS server, dockerized it, and created a K8S Deployment and ClusterIP service for it. I created a DNS for the LoadBalancer service external IP of istio-ingressgateway and I’m using this DNS to try access this TLS server using istio but for some reason this error appears</p>
<pre><code>[2022-02-10T04:28:38.302Z] &quot;- - -&quot; 0 NR filter_chain_not_found - &quot;-&quot; 0 0 3087 - &quot;-&quot; &quot;-&quot; &quot;-&quot; &quot;-&quot; &quot;-&quot; &quot;-&quot; - - 10.120.22.33:7070 10.101.31.172:44748 - -
</code></pre>
<p>The node server.js file:</p>
<pre><code>const tls = require(&quot;tls&quot;);
const fs = require(&quot;fs&quot;);

const options = {
  key: fs.readFileSync(&quot;server-key.pem&quot;),
  cert: fs.readFileSync(&quot;server-cert.pem&quot;),

  rejectUnauthorized: false,
};
process.env[&quot;NODE_TLS_REJECT_UNAUTHORIZED&quot;] = 0;
const server = tls.createServer(options, (socket) =&gt; {
  console.log(
    &quot;server connected&quot;,
    socket.authorized ? &quot;authorized&quot; : &quot;unauthorized&quot;
  );
  socket.write(&quot;welcome!\n&quot;);
  socket.setEncoding(&quot;utf8&quot;);
  socket.pipe(socket);
});
server.listen(7070, () =&gt; {
  console.log(&quot;server bound&quot;);
});
</code></pre>
<p>The client.js file I use to connect to the server:</p>
<pre><code>const tls = require(&quot;tls&quot;);
const fs = require(&quot;fs&quot;);

const options = {
  ca: [fs.readFileSync(&quot;server-cert.pem&quot;, { encoding: &quot;utf-8&quot; })],
};
var socket = tls.connect(
  7070,
  &quot;HOSTNAME&quot;,
  options,
  () =&gt; {
    console.log(
      &quot;client connected&quot;,
      socket.authorized ? &quot;authorized&quot; : &quot;unauthorized&quot;
    );
    process.stdin.pipe(socket);
    process.stdin.resume();
  }
);
socket.setEncoding(&quot;utf8&quot;);
socket.on(&quot;data&quot;, (data) =&gt; {
  console.log(data);
});

socket.on(&quot;end&quot;, () =&gt; {
  console.log(&quot;Ended&quot;);
});
</code></pre>
<p>The cluster service.yaml</p>
<pre><code>apiVersion: v1
kind: Service
metadata:
  name: nodejs-service
  namespace: nodejs-tcp
spec:
  ports:
  - name: web
    port: 7070
    protocol: TCP
    targetPort: 7070
  selector:
    app: nodejs
  sessionAffinity: None
  type: ClusterIP
</code></pre>
<p>The istio-gateway.yaml</p>
<pre><code>apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: nodejs-gw
  namespace: nodejs-tcp
spec:
  selector:
    istio: istio-ingressgateway
  servers:
  - hosts:
    - 'HOSTNAME'
    port:
      name: tls
      number: 7070
      protocol: TLS
    tls:
      credentialName: tls-secret
      mode: PASSTHROUGH
</code></pre>
<p>In credentialName, I created a generic secret that holds the values of the private key and the certificate of the server</p>
<p>The istio-virtual-service.yaml</p>
<pre><code>apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: nodejs-vs
  namespace: nodejs-tcp
spec:
  gateways:
  - nodejs-gw
  hosts:
  - 'HOSTNAME'
  tls:
  - match:
    - port: 7070
      sniHosts:
      - HOSTNAME
    route:
    - destination:
        host: nodejs-service
        port:
          number: 7070
</code></pre>
<p>The Istio version I’m using:</p>
<pre><code>client version: 1.12.2
control plane version: 1.12.2
data plane version: 1.12.2 (159 proxies)
</code></pre>
<p>Your help is so much appreciated. Thanks in advance.</p>

Kareem Yasser
<p>One thing I noticed right away is that you are using the incorrect selector in your <code>istio-gateway</code>, it should be:</p>
<pre><code>spec:
  selector:
    istio: ingressgateway
</code></pre>
<p>A good troubleshooting starting point would be to get the routes for your <code>ingressgateway</code> and validate that you see the expected ones.</p>
<ol>
<li>First you need to know your pod's name:</li>
</ol>
<pre><code>kubectl get pods -n &lt;namespace_of_your_app&gt;
NAME                                    READY   STATUS    RESTARTS   AGE
pod/my-nginx-xxxxxxxxx-xxxxx   2/2      Running   0          50m
</code></pre>
<p>In my deployment, it is an nginx pod.</p>
<ol start="2">
<li>Once you have the name, you can get the routes specific to your hostname:</li>
</ol>
<pre><code>istioctl pc routes &lt;your_pod_name&gt;.&lt;namespace&gt;
NOTE: This output only contains routes loaded via RDS.
NAME                                                          DOMAINS                               MATCH                  VIRTUAL SERVICE
my-nginx.default.svc.cluster.local:443                        my-nginx                              /*
</code></pre>
<p>This is an output example for a hostname &quot;my-nginx&quot;. If the output returns no route, it usually means that it does not match SNI and/or cannot find a specific route.</p>
