<p>I have a kubernetes pod configured as a webserver supporting https. This pod is giving the TLS handshake error logs. When we try to access the loadbalancer service IP on the browser, it gives error - the connection is not secure proceed to unsafe. For secure connection we have a self signed certificate mounted as a secret to the pod volume. If we remove support of https everything works fine. Can somebody suggest what could be the possible reason for such behaviour. </p>

PREETI BANSAL
<p>By default a https connection exist only between the browser and the loadbalancer. The loadbalancer communicates with pods using plain http. </p>

<pre>

<b>browser</b> -------------->|<b>loadbalancer</b>|-----------> <b>POD</b>
             https                      http
</pre>

<p>In that case, the certificate needs to be present on the loadbalancer, not on the POD, and you should disable HTTPS on the pod.</p>

<p>The loadbalancer can be configured to communicate with PODs using https, but it will be a different https connection:</p>

<pre>

<b>browser</b> -------------->|<b>loadbalancer</b>|-----------> <b>POD</b>
             https                      https
</pre>

<p>Here two certificates are needed, one on the loadbalancer and one on the pod itself.</p>

<p>The last option is pass-through SSL, but it's not enabled by default:</p>

<pre>
                        <b>loadbalancer</b>
<b>browser</b> --------------|--------------|-----------> <b>POD</b>
                           https
</pre>

<p>Here the certificate should be placed on the pod.</p>

<p>The way of configuring HTTPS depends on the used loadbalancer, cloud provider etc. If you are using Ingress, this page might help: <a href="https://www.thenativeweb.io/blog/2018-07-03-16-17-kubernetes-using-ingress-with-ssl-tls-termination-and-http2/#passing-through-https-and-http%2F2-with-ingress" rel="noreferrer">Kubernetes: Using Ingress with SSL/TLS termination and HTTP/2</a></p>

<p>Sidenote: browsers always complain about insecure connection when using a self-signed certificate (unless you configure them not to do it).</p>
