# How to use ingress-nginx with secure backend?

**URL:** <https://discuss.kubernetes.io/t/how-to-use-ingress-nginx-with-secure-backend/7347>\
**Category:** General Discussions\
**Created:** [July 30, 2019, 8:23am UTC](https://discuss.kubernetes.io/t/how-to-use-ingress-nginx-with-secure-backend/7347 "2019-07-30T08:23:06Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![asp](https://avatars.discourse-cdn.com/v4/letter/a/9fc348/32.png) [@asp](https://discuss.kubernetes.io/u/asp)\
**Post date:** [July 30, 2019, 8:23am UTC](https://discuss.kubernetes.io/t/how-to-use-ingress-nginx-with-secure-backend/7347/1 "2019-07-30T08:23:06Z")

</div>

Hi, I am using ingress-nginx for making kibana accessible from outside the cluster.  
I have the task to completely encrypt the application, so I think I need the following chain

Browser -\> TLS -\> ingress-nginx -\> TLS -\> service (kibana).  
Kibana will also use tls encryption to connect elasticsearch, which is working fine so far.

I am at this point now:

- using insecure ingress-nginx (http) with an insecure backend (http) -\> OK
- using secure ingress-nginx(https) with an insecure backend (http) -\> OK
- using secureingress-nginx (https) with secure backend (https) -\> FAILS

here is my ingress configuration:

```
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: test-ingress
  labels:
    cluster: test
    app: kibana
    product: elasticStack
  annotations:
  # nginx.ingress.kubernetes.io/rewrite-target: /test-kibana
  # enable to use secure backend
    nginx.ingress.kubernetes.io/secure-backends: "true"
spec:
  tls:
  - hosts:
    - elastic.ingress.kubernetes.internal.dtpublic.de
    secretName: elastic.ingress.kubernetes-tls
  rules:
  - host: elastic.ingress.kubernetes
    http:
      paths:
      - path: /test-kibana
        backend:
          serviceName: test-kibana
          servicePort: 5601

```

When I call the ingress url in browser with https, I get 502 bad gateway.

Log of ingress pods are showing this:

```
2019/07/30 08:16:17 [error] 44#44: *59001 upstream prematurely closed connection while reading response header from upstream, client: 172.22.19.152, server: elastic.ingress.kubernetes.internal.dtpublic.de, request: "GET /test-kibana/ HTTP/2.0", upstream: "http://192.168.198.160:5601/test-kibana/", host: "elastic.ingress.kubernetes.internal.dtpublic.de"

```

As you can see, it is forwarded to http, not https.

In kibana’s log I see following error:

```
{"type":"error","@timestamp":"2019-07-30T08:16:17Z","tags":["connection","client","error"],"pid":1,"level":"error","error":{"message":"139688227514240:error:1408F09C:SSL routines:ssl3_get_record:http request:../deps/openssl/openssl/ssl/record/ssl3_record.c:242:\n","name":"Error","stack":"Error: 139688227514240:error:1408F09C:SSL routines:ssl3_get_record:http request:../deps/openssl/openssl/ssl/record/ssl3_record.c:242:\n"},"message":"139688227514240:error:1408F09C:SSL routines:ssl3_get_record:http request:../deps/openssl/openssl/ssl/record/ssl3_record.c:242:\n"}

```

That is the identical error message as if i call the service via curl with http:  
`kubectl exec -it test-es-master-0 -- curl -k -L http://test-kibana:5601/test-kibana`  
instead of https:  
`kubectl exec -it test-es-master-0 -- curl -k -L https://test-kibana:5601/test-kibana`

https from inside a pod against the service is working like charm.

So what do I need to change to use a secure backend via tls?

Thanks, Andreas

---

<div class="post-metadata">

**Author:** ![asp](https://avatars.discourse-cdn.com/v4/letter/a/9fc348/32.png) [@asp](https://discuss.kubernetes.io/u/asp)\
**Post date:** [July 30, 2019, 9:34am UTC](https://discuss.kubernetes.io/t/how-to-use-ingress-nginx-with-secure-backend/7347/2 "2019-07-30T09:34:30Z")

</div>

found the solution. I added a second annotation:  
`nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"`

That made the trick

---

<div class="post-metadata">

**Author:** ![rata](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/rata/32/18244_2.png) [@rata](https://discuss.kubernetes.io/u/rata)\
**Post date:** [July 31, 2019, 10:17pm UTC](https://discuss.kubernetes.io/t/how-to-use-ingress-nginx-with-secure-backend/7347/3 "2019-07-31T22:17:54Z")

</div>

Great, thanks for sharing 🙂

---

<div class="post-metadata">

**Author:** ![PavanRaga](https://avatars.discourse-cdn.com/v4/letter/p/e480ec/32.png) [@PavanRaga](https://discuss.kubernetes.io/u/PavanRaga)\
**Post date:** [February 15, 2020, 11:36am UTC](https://discuss.kubernetes.io/t/how-to-use-ingress-nginx-with-secure-backend/7347/4 "2020-02-15T11:36:56Z")

</div>

ingress controller - kubectl apply -f [https://raw.githubusercontent.com/kubernetes/ingress-nginx/nginx-0.28.0/deploy/static/mandatory.yaml](https://raw.githubusercontent.com/kubernetes/ingress-nginx/nginx-0.28.0/deploy/static/mandatory.yaml)

ingress nodeprot - kubectl apply -f [https://raw.githubusercontent.com/kubernetes/ingress-nginx/nginx-0.28.0/deploy/static/provider/baremetal/service-nodeport.yaml](https://raw.githubusercontent.com/kubernetes/ingress-nginx/nginx-0.28.0/deploy/static/provider/baremetal/service-nodeport.yaml)

```auto
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: simple-fanout-example
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  rules:
  - host: foo.bar.com
    http:
      paths:
      - path: /foo
        backend:
          serviceName: service1
          servicePort: 4200
      - path: /bar
        backend:
          serviceName: service2
          servicePort: 8080

```

---

<div class="post-metadata">

**Author:** ![vaishali\_gupta](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/vaishali_gupta/32/5192_2.png) [@vaishali\_gupta](https://discuss.kubernetes.io/u/vaishali_gupta)\
**Post date:** [May 25, 2020, 6:55pm UTC](https://discuss.kubernetes.io/t/how-to-use-ingress-nginx-with-secure-backend/7347/5 "2020-05-25T18:55:57Z")

</div>

Can you tell how is it different from force-ssl-redirect annotation?

---

<div class="post-metadata">

**Author:** ![cryptosquirrels](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/cryptosquirrels/32/11143_2.png) [@cryptosquirrels](https://discuss.kubernetes.io/u/cryptosquirrels)\
**Post date:** [November 7, 2022, 2:38pm UTC](https://discuss.kubernetes.io/t/how-to-use-ingress-nginx-with-secure-backend/7347/6 "2022-11-07T14:38:36Z")

</div>

helm upgrade --install ingress-nginx ingress-nginx   
–repo [Welcome - NGINX Ingress Controller](https://kubernetes.github.io/ingress-nginx)   
–namespace ingress-nginx --create-namespace

---

<div class="post-metadata">

**Author:** ![qdii](https://avatars.discourse-cdn.com/v4/letter/q/7bcc69/32.png) [@qdii](https://discuss.kubernetes.io/u/qdii)\
**Post date:** [February 4, 2024, 1:36pm UTC](https://discuss.kubernetes.io/t/how-to-use-ingress-nginx-with-secure-backend/7347/7 "2024-02-04T13:36:30Z")

</div>

There are 3 components: the user, which connects to nginx, which itself connects to the backend (sometimes called “upstream”).

`force-ssl-redirect` instructs nginx that when a user connects to it in HTTP, it will send a redirect to the same URL with HTTPS. This is used to prevent clients connecting to nginx over HTTP, which is not encrypted.

`backend-protocol: "HTTPS"` instruct nginx to connect to the backend using HTTPS, instead of plain HTTP. It’s invisible to the user.