AWS Load balancer secure listener - ignore certificate in ingress-nginx

62 Views Asked by At

So I have an EKS cluster with ingress-nginx running inside, the service of ingress-nginx-controller is associated with the External IP of Load balancer type Network (say 123.elb.my-region.amazonaws.com).

The LB has a listener configured for port 443 and this listener has an SSL certificate in Secure listener settings. The used cert is a wildcard one matching *.foo.bar.com

Now I have a service in EKS which should be available under another subdomain, I've created a certificate as a k8s secret and declared its usage in ingress manifest for new service, like:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  namespace: foo
  name: new-service-ingress
spec:
  ingressClassName: nginx
  tls:
    - hosts:
      - new-service.new-foo.bar.com
      secretName: wildcard-new-foo-bar-com
  rules:
  - host: new-service.new-foo.bar.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: new-service
            port: 80

With all this, I can still see that the certificate from LB Secure listener settings in AWS is served. Is there a way to make the ingress-nginx ignore it and serve the one from k8s manifest -> from secret wildcard-new-foo-bar-com?

I can confirm this in browser and by

$ curl -k new-service.new-foo.bar.com
> curl: (60) SSL: no alternative certificate subject name matches target host name
0

There are 0 best solutions below