<p>I have a Java <a href="https://github.com/kahootali/SpringJavaMonitoringApp" rel="nofollow noreferrer">Spring Boot Application</a> and I have configured the server to run on SSL and it is mandatory.</p>
<pre><code>server:
  port: 8443
  ssl:
    enabled: true
    key-store-type: pkcs12
    key-store: ${KEYSTORE}
    key-password: ${KEYSTORE_PASSWORD}
    key-store-password: ${KEYSTORE_PASSWORD}
    client-auth: need
</code></pre>
<p>I have created a cert for my domain <code>*.kahootali.com</code> from LetsEncrypt certificate and created a p12 file for the keystore by running</p>
<pre><code>openssl pkcs12 -export -CAfile ca.crt -in cert.pem -inkey key.pem -certfile cert.pem -out kstore.p12
</code></pre>
<p>I want to expose it on Kubernetes using Ingress Nginx Controller, so I have created secret by</p>
<pre><code>kubectl create secret generic store --from-file=kstore.p12
</code></pre>
<p>I have deployed application, can see the <a href="https://github.com/kahootali/SpringJavaMonitoringApp/tree/main/deploy" rel="nofollow noreferrer">deployment files,</a> and when I port-forward local 8443 to its service's 8443 and run</p>
<pre><code>curl -iv --cacert ca.crt --cert mediator_cert.pem --key mediator_key.pem --resolve 'spring-app.kahootali.com:8443:127.0.0.1' https://spring-app.kahootali.com:8443/
</code></pre>
<p>It works fine and returns</p>
<pre><code>* Added spring-app.kahootali.com:8444:127.0.0.1 to DNS cache
* Hostname spring-app.kahootali.com was found in DNS cache
*   Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to spring-app.kahootali.com (127.0.0.1) port 8444 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: ca.crt
  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Request CERT (13):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Certificate (11):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS handshake, CERT verify (15):
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server did not agree to a protocol
* Server certificate:
*  subject: CN=*.kahootali.com
*  start date: Feb 11 10:27:47 2021 GMT
*  expire date: May 12 10:27:47 2021 GMT
*  subjectAltName: host &quot;spring-app.kahootali.com&quot; matched cert's &quot;*.kahootali.com&quot;
*  issuer: C=US; O=Let's Encrypt; CN=R3
*  SSL certificate verify ok.
&gt; GET / HTTP/1.1
&gt; Host: spring-app.kahootali.com:8444
&gt; User-Agent: curl/7.58.0
&gt; Accept: */*
&gt; 
&lt; HTTP/1.1 404 
HTTP/1.1 404 
&lt; X-Application-Context: application:8443
X-Application-Context: application:8443
&lt; Content-Type: application/json;charset=UTF-8
Content-Type: application/json;charset=UTF-8
&lt; Transfer-Encoding: chunked
Transfer-Encoding: chunked
&lt; Date: Sun, 14 Feb 2021 14:29:47 GMT
Date: Sun, 14 Feb 2021 14:29:47 GMT

&lt; 
* Connection #0 to host spring-app.kahootali.com left intact
{&quot;timestamp&quot;:1613312987350,&quot;status&quot;:404,&quot;error&quot;:&quot;Not Found&quot;,&quot;message&quot;:&quot;No message available&quot;,&quot;path&quot;:&quot;/&quot;}
</code></pre>
<p>But when I create an Ingress for it and ssl-passthrough it</p>
<pre><code>apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: spring-monitoring-app
  labels:
    app: spring-monitoring-app
  annotations:
    ingress.kubernetes.io/force-ssl-redirect: &quot;true&quot;
    ingress.kubernetes.io/rewrite-target: /
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/ssl-passthrough: &quot;true&quot;
spec:
  rules:
    - host: spring-app.kahootali.com
      http:
        paths:
          - path: /
            backend:
              serviceName: spring-monitoring-app
              servicePort: http
  tls:
    - hosts:
      - spring-app.kahootali.com
      secretName: tls-cert
</code></pre>
<p>It gives <code>ERR_BAD_SSL_CLIENT_AUTH_CERT</code> on browser and in app Debug level logs, it gives</p>
<pre><code>Error during SSL handshake
java.io.IOException: EOF during handshake.
The SNI host name extracted for this connection was [spring-app.kahootali.com]
Handshake failed during wrap
javax.net.ssl.SSLHandshakeException: Empty server certificate chain
</code></pre>

Ali Kahoot
<p><em>I'm posting my comment as an answer for better visibility:</em></p>
<p>As per  <a href="https://kubernetes.github.io/ingress-nginx/user-guide/tls/#ssl-passthrough" rel="nofollow noreferrer">the docs</a>  <strong>SSL Passthrough</strong>  feature is disabled by default. In order to enable it you need to start your  <strong>nginx-ingress controller</strong>  with  <code>--enable-ssl-passthrough</code>  flag. Make sure you didn't forget about it.</p>
<p>You may also take a look at this <a href="https://kubernetes.github.io/ingress-nginx/troubleshooting/#troubleshooting" rel="nofollow noreferrer">troubleshooting steps</a> to verify your <strong>nginx-ingress controller</strong> configuration.</p>
<p>Please let me know if it helps.</p>
