<p>I want to disable SNI on the nginx-ingress. If a call using openssl like below is used:</p>

<pre><code>openssl s_client -showcerts -connect ***********.gr:443
</code></pre>

<p>Then I want nginx-ingress to use only the certificate that I have configured and not the fake-k8s-cert.</p>

<p>The certificate is working if a browse the web app but I need also to set the default certificate.</p>

<p>An example is below:</p>

<pre><code>[root@production ~]# openssl s_client -showcerts -connect 3dsecureuat.torawallet.gr:443
CONNECTED(00000003)
depth=0 O = Acme Co, CN = Kubernetes Ingress Controller Fake Certificate
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 O = Acme Co, CN = Kubernetes Ingress Controller Fake Certificate
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
 0 s:/O=Acme Co/CN=Kubernetes Ingress Controller Fake Certificate
   i:/O=Acme Co/CN=Kubernetes Ingress Controller Fake Certificate
-----BEGIN CERTIFICATE-----

---
Server certificate
subject=/O=Acme Co/CN=Kubernetes Ingress Controller Fake Certificate
issuer=/O=Acme Co/CN=Kubernetes Ingress Controller Fake Certificate
---
Acceptable client certificate CA names
/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert Global Root CA
...
</code></pre>

<p>I have also configured ingress to use the secret on all hostnames without specifying host:
  tls:
  - secretName: ******wte-ingress</p>

vasilis
<p><a href="https://github.com/kubernetes/ingress-nginx/blob/master/docs/user-guide/tls.md#default-ssl-certificate" rel="noreferrer">Default SSL Certificate</a> flag solved the issue as OP mentioned.</p>
<p>In Nginx documentation you can read:</p>
<blockquote>
<p>NXINX Ingress controller provides the flag <code>--default-ssl-certificate</code>. The secret referred to by this flag contains the default certificate to be used when accessing the catch-all server. If this flag is not provided NGINX will use a self-signed certificate.</p>
<p>For instance, if you have a TLS secret foo-tls in the default namespace, add --default-ssl-certificate=default/foo-tls in the nginx-controller deployment.</p>
<p>The default certificate will also be used for ingress tls: sections that do not have a secretName option.</p>
</blockquote>
