title: TLS handshake errors in Kubernetes API server logs
body: <p>I'm working on a <a href="https://github.com/ericandrewlewis/kubernetes-via-terraform" rel="noreferrer">terraform configuration for a Kubernetes cluster in AWS</a>.</p>
  
  <p>I've got the cluster running. I can speak to it from my local machine via kubectl and start pods.</p>
  
  <p>I noticed kubectl taking 10s to respond after 12 hours of launching the cluster, so looked around for possible causes.</p>
  
  <p>I notice a lot of TLS handshake errors in the apiserver's container log that look like this</p>
  
  <pre><code>I0223 13:50:31.126486       1 logs.go:40] http: TLS handshake error from 10.0.3.5:49360: remote error: bad certificate
  I0223 13:50:31.168158       1 logs.go:40] http: TLS handshake error from 10.0.4.5:39214: remote error: bad certificate
  </code></pre>
  
  <p><code>10.0.3.5</code> and <code>10.0.4.5</code> are the Kubernetes worker/minion instances which I provisioned with <a href="https://github.com/ericandrewlewis/kubernetes-via-terraform/blob/master/user-data/worker.yml#L20-L30" rel="noreferrer">appropriate TLS assets</a>. Kubelet on the workers must be communicating with the apiserver — I see the nodes if I run <code>kubectl get nodes</code> on my computer, and I can launch pods via <code>kubectl</code> as well, which the workers would read from the API.</p>
  
  <p>Any thoughts on what these errors could mean?</p>