payload: {"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/ingress-nginx/issues/1984","repository_url":"https://api.github.com/repos/kubernetes/ingress-nginx","labels_url":"https://api.github.com/repos/kubernetes/ingress-nginx/issues/1984/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/ingress-nginx/issues/1984/comments","events_url":"https://api.github.com/repos/kubernetes/ingress-nginx/issues/1984/events","html_url":"https://github.com/kubernetes/ingress-nginx/issues/1984","id":291686506,"node_id":"MDU6SXNzdWUyOTE2ODY1MDY=","number":1984,"title":"HTTPS consistangly gives Fake Kubernetes Certificate","user":{"login":"pkelleratwork","id":31936503,"node_id":"MDQ6VXNlcjMxOTM2NTAz","avatar_url":"https://avatars3.githubusercontent.com/u/31936503?v=4","gravatar_id":"","url":"https://api.github.com/users/pkelleratwork","html_url":"https://github.com/pkelleratwork","followers_url":"https://api.github.com/users/pkelleratwork/followers","following_url":"https://api.github.com/users/pkelleratwork/following{/other_user}","gists_url":"https://api.github.com/users/pkelleratwork/gists{/gist_id}","starred_url":"https://api.github.com/users/pkelleratwork/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pkelleratwork/subscriptions","organizations_url":"https://api.github.com/users/pkelleratwork/orgs","repos_url":"https://api.github.com/users/pkelleratwork/repos","events_url":"https://api.github.com/users/pkelleratwork/events{/privacy}","received_events_url":"https://api.github.com/users/pkelleratwork/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":23,"created_at":"2018-01-25T19:25:32Z","updated_at":"2019-05-13T04:38:38Z","closed_at":"2018-01-26T15:12:48Z","author_association":"NONE","body":"<!-- Thanks for filing an issue! Before hitting the button, please answer these questions.-->\r\n\r\n**Is this a request for help?** (If yes, you should use our troubleshooting guide and community support channels, see https://kubernetes.io/docs/tasks/debug-application-cluster/troubleshooting/.):\r\n\r\n**What keywords did you search in NGINX Ingress controller issues before filing this one?** (If you have found any duplicates, you should instead reply there.):\r\n\r\n---\r\n\r\n**Is this a BUG REPORT or FEATURE REQUEST?** (choose one):\r\n\r\n<!--\r\nIf this is a BUG REPORT, please:\r\n  - Fill in as much of the template below as you can.  If you leave out\r\n    information, we can't help you as well.\r\n\r\nIf this is a FEATURE REQUEST, please:\r\n  - Describe *in detail* the feature/behavior/change you'd like to see.\r\n\r\nIn both cases, be ready for followup questions, and please respond in a timely\r\nmanner.  If we can't reproduce a bug or think a feature already exists, we\r\nmight close your issue.  If we're wrong, PLEASE feel free to reopen it and\r\nexplain why.\r\n-->\r\n\r\n**NGINX Ingress controller version**:   \r\nhelm stable/nginx-ingress\r\n\r\n\r\n**Kubernetes version** (use `kubectl version`):\r\nClient Version: version.Info{Major:\"1\", Minor:\"9\", GitVersion:\"v1.9.1\", GitCommit:\"3a1c9449a956b6026f075fa3134ff92f7d55f812\", GitTreeState:\"clean\", BuildDate:\"2018-01-04T11:52:23Z\", GoVersion:\"go1.9.2\", Compiler:\"gc\", Platform:\"darwin/amd64\"}\r\nServer Version: version.Info{Major:\"1\", Minor:\"8\", GitVersion:\"v1.8.1\", GitCommit:\"f38e43b221d08850172a9a4ea785a86a3ffa3b3a\", GitTreeState:\"clean\", BuildDate:\"2017-10-11T23:16:41Z\", GoVersion:\"go1.8.3\", Compiler:\"gc\", Platform:\"linux/amd64\"}\r\n\r\n**Environment**:\r\nstaging\r\n\r\n- **Cloud provider or hardware configuration**: \r\nAzure\r\n- **OS** (e.g. from /etc/os-release):\r\nCentOS7\r\n\r\n- **Kernel** (e.g. `uname -a`):\r\nDarwin Kernel Version 17.3.0: Thu Nov  9 18:09:22 PST 2017; root:xnu-4570.31.3~1/RELEASE_X86_64 x86_64\r\n\r\n- **Install tools**:\r\nhelm\r\nkubectl\r\n\r\n- **Others**:\r\nhave front end ingress controller pointed to pod containg nginx and multi app containers\r\n\r\n**What happened**:\r\nHTTPS presents 404 backend\r\nHTTP works\r\n\r\n**What you expected to happen**:\r\nHTTPS should work\r\n\r\n\r\n**How to reproduce it** (as minimally and precisely as possible):\r\n$ helm install stable/nginx-ingress\r\n$ kubectl get pods -n=kube-system\r\n```\r\nNAME                                                             READY     STATUS    RESTARTS   AGE\r\nolfactory-prawn-nginx-ingress-controller-d44cd7595-mbklx         1/1       Running   0          28m\r\nolfactory-prawn-nginx-ingress-default-backend-6d45c95c66-j8pgj   1/1       Running   0          28m\r\n```\r\n$kubectl get services -n=kube-system\r\n```\r\nNAME                                            TYPE           CLUSTER-IP     EXTERNAL-IP     PORT(S)                      AGE\r\nolfactory-prawn-nginx-ingress-controller        LoadBalancer   10.0.2.170     52.165.230.62   80:31713/TCP,443:32578/TCP   29m\r\nolfactory-prawn-nginx-ingress-default-backend   ClusterIP      10.0.236.187   <none>          80/TCP                       29m\r\n\r\n```\r\n```\r\nnginx-ingress.yaml\r\napiVersion: extensions/v1beta1\r\nkind: Ingress\r\nmetadata:\r\n  name: nginx-ingress\r\n  namespace: kube-system\r\n  annotations:\r\n    kubernetes.io/ingress.class: \"nginx\"\r\nspec:\r\n  rules:\r\n    - host: subdomain.domain.com\r\n      http:\r\n        paths:\r\n          - backend:\r\n              serviceName: ingress-nginx\r\n              servicePort: 80\r\n            path: /\r\n  tls:\r\n    - hosts:\r\n      - subdomain.domain.com\r\n    secretName: tls-secret\r\n```\r\n\r\nupload secret\r\n$ kubectl create secret tls tls-secret --key tls.key --cert tls.crt -n=kube-system\r\n\r\nupload ingress.yaml\r\n $ kubectl create -f nginx-ingress.yaml -n=kube-system\r\n\r\n```\r\n$ curl -v https://52.165.230.62\r\n* Rebuilt URL to: https://52.165.230.62/\r\n*   Trying 52.165.230.62...\r\n* TCP_NODELAY set\r\n* Connected to 52.165.230.62 (52.165.230.62) port 443 (#0)\r\n* ALPN, offering h2\r\n* ALPN, offering http/1.1\r\n* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH\r\n* successfully set certificate verify locations:\r\n*   CAfile: /etc/ssl/cert.pem\r\n  CApath: none\r\n* TLSv1.2 (OUT), TLS handshake, Client hello (1):\r\n* TLSv1.2 (IN), TLS handshake, Server hello (2):\r\n* TLSv1.2 (IN), TLS handshake, Certificate (11):\r\n* TLSv1.2 (OUT), TLS alert, Server hello (2):\r\n* SSL certificate problem: unable to get local issuer certificate\r\n* stopped the pause stream!\r\n* Closing connection 0\r\ncurl: (60) SSL certificate problem: unable to get local issuer certificate\r\n\r\n```\r\nSSL continues to default to Kubernetes fake certificate.\r\n\r\nthanks.\r\n\r\n**Anything else we need to know**:\r\n"},"comment":{"url":"https://api.github.com/repos/kubernetes/ingress-nginx/issues/comments/491673247","html_url":"https://github.com/kubernetes/ingress-nginx/issues/1984#issuecomment-491673247","issue_url":"https://api.github.com/repos/kubernetes/ingress-nginx/issues/1984","id":491673247,"node_id":"MDEyOklzc3VlQ29tbWVudDQ5MTY3MzI0Nw==","user":{"login":"2anoopp","id":20985471,"node_id":"MDQ6VXNlcjIwOTg1NDcx","avatar_url":"https://avatars2.githubusercontent.com/u/20985471?v=4","gravatar_id":"","url":"https://api.github.com/users/2anoopp","html_url":"https://github.com/2anoopp","followers_url":"https://api.github.com/users/2anoopp/followers","following_url":"https://api.github.com/users/2anoopp/following{/other_user}","gists_url":"https://api.github.com/users/2anoopp/gists{/gist_id}","starred_url":"https://api.github.com/users/2anoopp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/2anoopp/subscriptions","organizations_url":"https://api.github.com/users/2anoopp/orgs","repos_url":"https://api.github.com/users/2anoopp/repos","events_url":"https://api.github.com/users/2anoopp/events{/privacy}","received_events_url":"https://api.github.com/users/2anoopp/received_events","type":"User","site_admin":false},"created_at":"2019-05-13T04:38:38Z","updated_at":"2019-05-13T04:38:38Z","author_association":"NONE","body":"> @aledbf thanks let me check that... Im not sure thats the issue but here's what gitlab's runner complains about when it tries to register:\r\n> \r\n> ```\r\n> status=couldn't execute POST against https://gitlab.evanrichardsonphotography.com/api/v4/runners: Post https://gitlab.evanrichardsonphotography.com/api/v4/runners: x509: cert\r\n> ificate signed by unknown authority\r\n> ```\r\n> \r\n> SSLlabs seems to show comodo though.. let me try the intermediate cert.\r\n> \r\n> edit: damn you're right. Intermediate was missing, was only the base crt. going to try with the intermediate + root added. thanks!\r\n\r\n@evanrich/ @aledbf   Can you explain how did you edit the crt file with intermediate . We have met the same problem.\r\nI have added the intermediate certificate with certificate file and try to add using tls as well as generic secret both didn't work. \r\n\r\nGeneric\r\n---------\r\nkubectl create secret generic example-cert --from-file=tls.crt=fullchain.crt --from-file=tls.key=privkey.key\r\n\r\ntsl\r\n---\r\nkubectl create secret tls example-cert --key api-privkey.key --cert api-fullychain.crt\r\n"}}
other: {"actor":{"display_login":"2anoopp"}}