<p>I am running a service on kubernetes Azure AKS Cluster.</p>

<p><code>Istio-version: 1.3.2</code></p>

<p>My service is listening to both port 80 and 443:</p>

<pre class="lang-sh prettyprint-override"><code>NAME               TYPE        CLUSTER-IP    EXTERNAL-IP   PORT(S)          AGE
hello-kubernetes   ClusterIP   10.0.43.233   &lt;none&gt;        80/TCP,443/TCP   28h
</code></pre>

<p>Also istio-gateway.yaml file looks like below:</p>

<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: my-gateway
spec:
  selector:
    istio: ingressgateway 
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*"
    #tls:
      #httpsRedirect: true
  - port:
      number: 443
      name: https
      protocol: HTTPS
    hosts:
    - "*"
    tls:
      mode: SIMPLE
      credentialName: "mycert" # must be the same as secret
      privateKey: sds
      serverCertificate: sds
      #serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
      #privateKey: /etc/istio/ingressgateway-certs/tls.key
</code></pre>

<p>The secret is created by below command- I have a custom certificate that I have uploaded on the cluster:</p>

<pre class="lang-sh prettyprint-override"><code>kubectl create -n istio-system secret generic mycert \
  --from-file=key=/home/user/istio-1.3.2/ssl/myprivate.key \
  --from-file=cert=/home/user/istio-1.3.2/ssl/mycert.pem
</code></pre>

<p>mycert.pem file includes both certificate key and intermediate key.</p>

<p>The VirtualService file is like:</p>

<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: hello-kubernetes
spec:
  hosts:
  - "mydomain.com"
  gateways:
  - my-gateway
  http:
  - match:
    - uri:
        prefix: /hello-k8s
    route:
    - destination:
        host: hello-kubernetes
</code></pre>

<p>If I curl it with http, it give me 200 OK response however when I curl it with https port, it gives HTTP/1.1 503 Service Unavailable.</p>

<p>Error message on the browser is:
NET::ERR_CERT_AUTHORITY_INVALID</p>

<p>Any idea of what it is missing?</p>

Matrix
<p>The error is fixed by adding:</p>

<pre><code>port:
   number: 80
</code></pre>

<p>in destination part of virtual service file. </p>
