<p>I have a couple of microservices and our backend is opendj/ldap. It has been configured to use SSL. Now we are trying to use ISTIO as our k8s service mesh. Every other service works fine but the ldap server - opendj - is not. My gues is it's because of the ssl configuration. It's meant to use self-signed cert.</p>

<p>I have a script that creates a self-signed cert in istio namespace and I have tried to use it like this on the <code>gateway.yaml</code></p>

<pre><code>  - port:
      number: 4444
      name: tcp-admin
      protocol: TCP
    hosts:
    - "*"
    tls:
      mode: SIMPLE # enable https on this port
      credentialName: tls-certificate # fetch cert from k8s secret

</code></pre>

<p>I also have tried to use </p>

<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: opendj-istio-mtls
spec:
  host: opendj.{{.Release.Namespace }}.svc.cluster.local
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
      credentialName: tls-certificate

---

apiVersion: authentication.istio.io/v1alpha1
kind: Policy
metadata:
  name: opendj-receive-tls
spec:
  targets:
  - name: opendj
  peers:
  - mtls: {}
</code></pre>

<p>For the ldap server but it's not connecting. While trying to use the <code>tls</code> spec in <code>gateway.yaml</code> I am getting this error</p>

<pre><code>Error: admission webhook "pilot.validation.istio.io" denied the request: configuration is invalid: server cannot have TLS settings for non HTTPS/TLS ports
</code></pre>

<p>And the logs from opendj server</p>

<pre><code>
INFO - entrypoint - 2020-06-17 12:49:44,768 - Configuring OpenDJ.
WARNING - entrypoint - 2020-06-17 12:49:48,987 - 
Unable to connect to the server at
"oj-opendj-0.opendj.default.svc.cluster.local" on port 4444


WARNING - entrypoint - 2020-06-17 12:49:53,293 - 
Unable to connect to the server at
"oj-opendj-0.opendj.default.svc.cluster.local" on port 4444

</code></pre>

<p>Can someone please help me out how I should approach this.</p>

Shammir
<p>To Enable non-https traffic over TLS connections you have to use Protocol TLS. TLS implies the connection will be routed based on the <strong>SNI header</strong> to the destination without terminating the TLS connection. You can check <a href="https://github.com/istio/istio/issues/20076" rel="nofollow noreferrer">this</a>.</p>

<pre><code>  - port:
      number: 4444
      name: tls
      protocol: TLS
    hosts:
    - "*"
    tls:
      mode: SIMPLE # enable https on this port
      credentialName: tls-certificate # fetch cert from k8s secret
</code></pre>

<p>Please check this istio <a href="https://istio.io/latest/docs/reference/config/networking/gateway/#Port" rel="nofollow noreferrer">documentation</a> also.</p>
