title: Let's Encrypt with HApRoxy on GKE
body: <p>I am following some articles to implement SSL on my application. But not able to understand how to generate the certificate or do I need to generate the certificate or not?</p>
  
  <p>The main thing is, in concept, I am not able to put the things together.</p>
  
  <p>Let me explain the situation.</p>
  
  <p>I am running an application "User Registration" (REST API Based) in GKE cluster with HAProcxy Ingress Controller and HTTP(S) L7 loadbalancer. I have an existing domain (e.g. mydomain.com) where I am hosting my website. The hosting platform has provided a SSL certificate which is securing wild card domain (*.mydomain.com) and my website opens with http(colon)(slash slash) mydomain.com. I have created a subdomain apps.mydomain.com and pointed "A" record to the GCP HTTP(S) loadbalancer IP, so that I can access the application over the internet. I can access my application over the internet on port 80. But it does not work on Post 443 (with https).</p>
  
  <p>In the articles, I need to generate a certificate and key using ACME and the same need to be used in Cluster Issuer and Ingress. </p>
  
  <p>Ref# digitalocean.com/community/tutorials/how-to-set-up-an-nginx-ingress-with-cert-manager-on-digitalocean-kubernetes</p>
  
  <p>Do I need to ask my domain/hosting provider for the Certificate and Key?
  Or I can use ACME to generate another certificate with hostname: apps.mydomain.com?</p>
  
  <p>Even I downloaded the certificate and key from my hosting provided website (there was an option - user you own server) and used the same in the Ingress only (used the certificate and ley as a secret). But my website turned into an insecure mode and when curl the API <a href="https://apps.mydomain.com/CreteUser" rel="nofollow noreferrer">https://apps.mydomain.com/CreteUser</a> there was an error:</p>
  
  <h2> TCP_NODELAY set</h2>
  
  <ul>
  <li>schannel: failed to receive handshake, need more data</li>
  <li>schannel: SSL/TLS connection with apps.mydomain.com port 443 (step 2/3)</li>
  <li>schannel: encrypted data got 1845</li>
  <li>schannel: encrypted data buffer: offset 1845 length 4096</li>
  <li>schannel: SNI or certificate check failed: SEC_E_WRONG_PRINCIPAL (0x80090322) - The target principal name is incorrect.</li>
  <li>Closing connection 0</li>
  <li>schannel: shutting down SSL/TLS connection with demo.apps.product.barnsleypujo.co.uk port 443</li>
  <li>schannel: clear security context handle
  curl: (35) schannel: SNI or certificate check failed: SEC_E_WRONG_PRINCIPAL (0x80090322) - The target principal name is incorrect.</li>
  </ul>
  
  <p>Could you please help me out?</p>
  
  <p>Thanks,
  Suvendu</p>