title: Istio: Unable to set up mutual TLS origination with an egress gateway, custom CA certificates
body: <p>I am having problem with configuration of mutual TLS origination with an egress gateway. I am using the configuration provided in the documentation: <a href="https://istio.io/latest/docs/tasks/traffic-management/egress/egress-gateway-tls-origination-sds/#perform-mutual-tls-origination-with-an-egress-gateway" rel="nofollow noreferrer">https://istio.io/latest/docs/tasks/traffic-management/egress/egress-gateway-tls-origination-sds/#perform-mutual-tls-origination-with-an-egress-gateway</a>.</p>
  <p>I am getting following error message for curl:</p>
  <pre><code>kubectl exec &quot;$(kubectl get pod -l app=sleep -o jsonpath={.items..metadata.name})&quot; -c sleep -- curl -s -v 'http://ADDRESS_HERE/Service/something'
  
  [2021-02-05T08:14:26.529Z] &quot;GET /Service/something HTTP/1.1&quot; 503 UF,URX &quot;TLS error: 100663398:public key routines:OPENSSL_internal:DECODE_ERROR 184549501:X.509 certificate routines:OPENSSL_internal:PUBLIC_KEY_DECODE_ERROR 268435581:SSL routines:OPENSSL_internal:CERTIFICATE_VERIFY_FAILED&quot; 0 333 41 - &quot;10.240.0.214&quot; &quot;Apache-HttpClient/4.5.3 (Java/11.0.10)&quot; &quot;3a4b121d-e232-4a89-8798-f7251e74e601&quot; &quot;&lt;ADDRESS_HERE&gt;&quot; &quot;&lt;IP_ADDRESS_HERE&gt;:9443&quot; outbound|9443||&lt;ADDRESS_HERE&gt; - 10.240.0.42:9443 10.240.0.214:60150 &lt;ADDRESS_HERE&gt; -
  </code></pre>
  <p>It looks like there is an issue related to certificate but I am able to access external service with curl and the same certificate provided as the parameters of curl command. I think the isseu may be related to fact that custom certificates are not trusted by each side. Is there any way to fix it?</p>
  <p>Here's my configuration:</p>
  <p>Istio 1.8.0:</p>
  <pre><code>apiVersion: networking.istio.io/v1beta1
  kind: ServiceEntry
  metadata:
    name: externalservice-egress
  spec:
    hosts:
    - api.externalservice.com
    ports:
    - number: 9443
      name: https
      protocol: HTTPS
    resolution: DNS
    location: MESH_EXTERNAL
  ---
  apiVersion: networking.istio.io/v1beta1
  kind: Gateway
  metadata:
    name: externalservice-egress
  spec:
    selector:
      istio: egressgateway
    servers:
    - port:
        number: 9443
        name: https
        protocol: HTTPS
      hosts:
      - api.externalservice.com
      tls:
        mode: ISTIO_MUTUAL
  ---
  apiVersion: networking.istio.io/v1beta1
  kind: DestinationRule
  metadata:
    name: externalservice-egress
  spec:
    host: istio-egressgateway.istio-system.svc.cluster.local
    subsets:
    - name: externalservice-egress
      trafficPolicy:
        loadBalancer:
          simple: ROUND_ROBIN
        portLevelSettings:
        - port:
            number: 9443
          tls:
            mode: ISTIO_MUTUAL
            sni: api.externalservice.com
  ---
  apiVersion: networking.istio.io/v1beta1
  kind: VirtualService
  metadata:
    name: externalservice
  spec:
    hosts:
      - api.externalservice.com
    gateways:
      - externalservice-egress
      - mesh
    http:
    - match:
      - gateways:
        - mesh
        port: 80
      route:
      - destination:
          host: istio-egressgateway.istio-system.svc.cluster.local
          subset: externalservice-egress
          port:
            number: 9443
        weight: 100
    - match:
      - gateways:
        - externalservice-egress
        port: 9443
      route:
      - destination:
          host: api.externalservice.com
          port:
            number: 9443
        weight: 100
  ---
  apiVersion: networking.istio.io/v1beta1
  kind: DestinationRule
  metadata:
    name: externalservice-egress-tls-origination
    namespace: istio-system # namespace other than for other configuration items - like for example from documentation
  spec:
    host: api.externalservice.com
    trafficPolicy:
      loadBalancer:
        simple: ROUND_ROBIN
      portLevelSettings:
      - port:
          number: 9443
        tls:
          mode: MUTUAL
          credentialName: client-credential
          sni: api.externalservice.com
  </code></pre>
  <p>Kubernetes secret:</p>
  <pre><code>kubectl describe secret -n istio-system client-credential 
  
  Name:         client-credential
  Namespace:    istio-system
  Labels:       &lt;none&gt;
  Annotations:  &lt;none&gt;
  
  Type:  Opaque
  
  Data
  ====
  tls.key:  1679 bytes
  ca.crt:   1525 bytes
  tls.crt:  1956 bytes
  </code></pre>
  <p>api.externalservice.com is an external service listening only on https/9443.</p>
  <p>I believe that client.crt, client.key and ca.crt used for creating this secret are correct because I could connect to api.externalservice.com from outside the mesh:</p>
  <pre><code>curl -k --cert client.crt --key client.key -v https://ADDRESS_HERE:9443/Service/something
  </code></pre>
  <p>Thank you for helping me with this. I appreciate any ideas how to resolve this issue.</p>
  <p>EDIT: OK, it looks like I need to provide ca cartificate somewhere:</p>
  <pre><code>Error [IST0129] (DestinationRule rule) DestinationRule namespace/rule in namespace namespace has TLS mode set to MUTUAL but no caCertificates are set to validate server identity for host: &lt;ADDRESS_HERE&gt; at port number:9443
  </code></pre>
  <p>I am using Egress Gateway, so should I mount this certificate to the Egress GW pod?</p>
  <p>EDIT2: Also, I was under the impression that certificate management is handled by client-credential secret. Is it really needed to also add caCertificates parameter?</p>