title: Istio outbound https traffic troubleshooting
body: <p>I have 2 AKS clusters, Cluster 1 and Cluster 2 both running Istio 1.14 minimal out-of-the-box (default configs).</p>
  <p>Everything on Cluster 1 works as expected (after deploying Istio).</p>
  <p>On Cluster 2, all HTTPS outbound connections initiated from my services (injected with istio-proxy) fail.</p>
  <pre><code>curl http://www.google.com  #works
  curl https://www.google.com #fails
  </code></pre>
  <p>If I create a service entry for google, then the https curl works:</p>
  <pre><code>apiVersion: networking.istio.io/v1alpha3
  kind: ServiceEntry
  metadata:
    name: google
  spec:
    hosts:
    - www.google.com
    ports:
    - number: 443
      name: https
      protocol: HTTPS
    resolution: DNS
    location: MESH_EXTERNAL
  </code></pre>
  <p>Both Istio installations are out-of-the-box so <code>meshConfig.outboundTrafficPolicy.mode</code> is set to <code>ALLOW_ANY</code> (double-checked).</p>
  <p>I read online that there were some Istio bugs that would cause this behavior, but I don't think it's the case here. I also compared the Istio configs between the 2 clusters and they really seem to be the same.</p>
  <p>I'm starting to think the problem may lie in some cluster configs because I know there are some differences between the 2 clusters here.</p>
  <p>How would you go about troubleshooting this? Do you think the issue is related to Istio or Cluster services/configs? What should I look into first?</p>