title: Kubernetes: Nginx Ingress Annotation ----> nginx.ingress.kubernetes.io/secure-backends
body: <p>Issue: I am trying to reach a vault cluster which is hosted on my k8's cluster using ingress.Currently using nginx ingress controller <code>0.10.2</code> version.</p>
  
  <p>I am using custom generated TLS certs with Ingress which is pointing to the Vault cluster.I have the TLS certs in the same namespace as ingress.</p>
  
  <p>Problem: Unable to reach the backend by providing the <code>vault status</code> command with the ca.crt for ingress.</p>
  
  <p>Env variables set are</p>
  
  <pre><code>        VAULT_ADDR=https://vault.ingress.staging.k8s.com
          VAULT_SKIP_VERIFY=true
  </code></pre>
  
  <p>Unable to get the status i.e the traffic is being stopped at the ingress itself. When I check the logs for the ingress controller it says</p>
  
  <p><code>7 backend_ssl.go:146] unexpected error generating SSL certificate with full intermediate chain CA certs: Invalid certificate.</code></p>
  
  <p>I have generated the custom TLS certs matching the Common Name of the Ingress resource. So unable to figure out why is this happening. Thought might be due to the wrong ingress annotations usage.</p>
  
  <p>My question is there anything going wrong with <code>ingress.kubernetes.io/secure-backends: 'true'</code>, if yes can you provide info about how to use it? </p>
  
  <p><strong>Notes:</strong></p>
  
  <ul>
  <li><p>I am using the appropriate ingress class and know that there is no problem with that, for sure.</p></li>
  <li><p>I have deployed few examples to check, if there is any problem with ingress. Even that is working fine.</p></li>
  </ul>
  
  <p><strong>* Can anyone provide a working example for <code>nginx.ingress.kubernetes.io/secure-backends</code> *</strong></p>
  
  <p>Any solution related to this issue would be appreciated!!!</p>
  
  <p><strong><em>Ingress.yaml</em></strong></p>
  
  <pre><code>kind: Ingress
  apiVersion: extensions/v1beta1
  metadata:
    name: vault
    namespace: default
    annotations:
      ingress.kubernetes.io/secure-backends: 'true'
      kubernetes.io/ingress.class: "k8s"
  spec:
    tls:
      - hosts:
          - vault.ingress.staging.k8s.com
        secretName: vault-server-ingress-tls
    rules:
      - host: vault.ingress.staging.k8s.com
        http:
          paths:
            - path: /
              backend:
                serviceName: example
                servicePort: 8200
  </code></pre>