<p>I am running Istio 1.5, where SDS is enabled by default apparently, and am trying to enable TLS on north-south traffic in my EKS cluster (v1.15) and I have done the following:</p>
<ul>
<li>Followed steps here to set up a sample application <a href="https://istio.io/latest/docs/setup/getting-started/" rel="nofollow noreferrer">https://istio.io/latest/docs/setup/getting-started/</a></li>
<li>Installed cert manager 0.15.1</li>
<li>Created a cluster issuer</li>
<li>Configured the cluster issuer to attempt to solve the DNS challenge by integrating it with AWS Route53</li>
<li>Generate a certificate using the cluster issuer and letsencrypt</li>
<li>Followed the steps here to configure the gateway and virtual service with the certificate created above <a href="https://istio.io/latest/docs/tasks/traffic-management/ingress/secure-ingress/" rel="nofollow noreferrer">https://istio.io/latest/docs/tasks/traffic-management/ingress/secure-ingress/</a></li>
<li>I copied the root certificate of letsencrypt to pass through the curl command</li>
<li>Tried to curl to the IP of the loadbalancer and I get this error</li>
</ul>
<p><a href="https://i.stack.imgur.com/GWqbY.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/GWqbY.jpg" alt="" /></a></p>
<p>Can anyone please guide me on how to resolve this?</p>

YYashwanth
<p>There is related <a href="https://istio.io/latest/docs/ops/integrations/certmanager/" rel="nofollow noreferrer">documentation</a> about integration cert-menager and istio.</p>
<h2>cert-manager</h2>
<blockquote>
<p>Configuration</p>
<p>Consult the <a href="https://cert-manager.io/docs/installation/kubernetes/" rel="nofollow noreferrer">cert-manager installation documentation</a> to get started. No special changes are needed to work with Istio.</p>
<p>Usage</p>
<p>Istio Gateway
cert-manager can be used to write a secret to Kubernetes, which can then be referenced by a Gateway. To get started, configure a Certificate resource, following the <a href="https://cert-manager.io/docs/usage/certificate/" rel="nofollow noreferrer">cert-manager documentation</a>. The Certificate should be created in the same namespace as the istio-ingressgateway deployment. For example, a Certificate may look like:</p>
</blockquote>
<pre><code>apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
  name: ingress-cert
  namespace: istio-system
spec:
  secretName: ingress-cert
  commonName: my.example.com
  dnsNames:
  - my.example.com
  ...
</code></pre>
<blockquote>
<p>Once we have the certificate created, we should see the secret created in the istio-system namespace. This can then be referenced in the tls config for a Gateway under credentialName:</p>
</blockquote>
<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    tls:
      mode: SIMPLE
      credentialName: ingress-cert # This should match the Certifcate secretName
    hosts:
    - my.example.com # This should match a DNS name in the Certificate
</code></pre>
<blockquote>
<p><a href="https://istio.io/latest/docs/tasks/traffic-management/ingress/kubernetes-ingress/" rel="nofollow noreferrer">Kubernetes Ingress</a></p>
<p>cert-manager provides direct integration with Kubernetes Ingress by configuring an <a href="https://cert-manager.io/docs/usage/ingress/" rel="nofollow noreferrer">annotation on the Ingress object</a>. If this method is used, the Ingress must reside in the same namespace as the istio-ingressgateway deployment, as secrets will only be read within the same namespace.</p>
<p>Alternatively, a Certificate can be created as described in <a href="https://istio.io/latest/docs/ops/integrations/certmanager/#istio-gateway" rel="nofollow noreferrer">Istio Gateway</a>, then referenced in the Ingress object:</p>
</blockquote>
<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: ingress
  annotations:
    kubernetes.io/ingress.class: istio
spec:
  rules:
  - host: my.example.com
    http: ...
  tls:
  - hosts:
    - my.example.com # This should match a DNS name in the Certificate
    secretName: ingress-cert # This should match the Certifcate secretName
</code></pre>
<hr />
<p>Additionally there is full <a href="https://discuss.istio.io/t/problems-with-istio-ingress-and-cert-manager/5241/14" rel="nofollow noreferrer">reproduction</a> made by @chrisnyc with cert-menager and lets encrypt on istio discuss, which as @YYashwanth mentioned in comments solved his problem. So if you have similar issue take a look at above reproduction.</p>
