<p>Using <a href="https://github.com/fabric8io/kubernetes-client" rel="nofollow noreferrer">fabric8 kubernetes client</a>, I received a different certificate than with curl on the same endpoint.</p>
<p>Specifically, I received the ingress self-signed certificate (CN=Kubernetes Ingress Controller Fake Certificate) instead of the specified one.</p>
<p>Ingress configuration (result of <code>kubectl edit ingress</code>)</p>
<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  creationTimestamp: &quot;2020-08-07T09:33:18Z&quot;
  generation: 1
  labels:
    app: dummy
    app.kubernetes.io/component: dummy-component
    app.kubernetes.io/instance: dummy-instance
    app.kubernetes.io/managed-by: Dummy
    app.kubernetes.io/name: dummy
    app.kubernetes.io/part-of: dummy-sample
    app.kubernetes.io/version: 1.12.0-SNAPSHOT
  managedFields:
  - apiVersion: extensions/v1beta1
    fieldsType: FieldsV1
    fieldsV1:
      f:metadata:
        f:labels:
          .: {}
          f:app: {}
          f:app.kubernetes.io/component: {}
          f:app.kubernetes.io/instance: {}
          f:app.kubernetes.io/managed-by: {}
          f:app.kubernetes.io/name: {}
          f:app.kubernetes.io/part-of: {}
          f:app.kubernetes.io/version: {}
      f:spec:
        f:rules: {}
        f:tls: {}
    manager: okhttp
    operation: Update
    time: &quot;2020-08-07T09:33:18Z&quot;
  - apiVersion: networking.k8s.io/v1beta1
    fieldsType: FieldsV1
    fieldsV1:
      f:status:
        f:loadBalancer:
          f:ingress: {}
    manager: nginx-ingress-controller
    operation: Update
    time: &quot;2020-08-07T09:33:19Z&quot;
  name: dummy-instance
  namespace: dummy-namespace
  resourceVersion: &quot;1887&quot;
  selfLink: /apis/extensions/v1beta1/namespaces/dummy-namespace/ingresses/dummy-instance
  uid: 2b7839fa-da65-45f3-9f1f-8169cf1325d8
spec:
  rules:
  - host: minikube
    http:
      paths:
      - backend:
          serviceName: dummy-instance
          servicePort: 9999
        path: /dummy-instance
        pathType: ImplementationSpecific
  tls:
  - hosts:
    - minikube
    secretName: minikube-tls-3
status:
  loadBalancer:
    ingress:
    - ip: 172.17.0.3
</code></pre>
<p>I cannot see a reason where the Ingress would return a different certificate for the same host, on the same endpoint, with a different client.</p>
<p>My only guess was that the certificate contain in the secret was not compatible (or was having a lower priority on the cipher?) with the fabric8 ClientHello (okhttp3 here), but it's not the case.</p>
<p>I'm running out of debugging idea, so if you have a guess on that, it would be welcome!</p>

Neok
<p>Client doesn't send the SNI extension on the ClientHello.</p>
