# Nginx.ingress.kubernetes.io/auth-tls-verify-client: "on" is not working
**URL:** https://discuss.kubernetes.io/t/nginx-ingress-kubernetes-io-auth-tls-verify-client-on-is-not-working/16170
**Category:** General Discussions
**Created:** [June 4, 2021, 1:06pm UTC](https://discuss.kubernetes.io/t/nginx-ingress-kubernetes-io-auth-tls-verify-client-on-is-not-working/16170 "2021-06-04T13:06:20Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Nick13](https://discuss.kubernetes.io/u/Nick13)
#### Post date: [June 4, 2021, 1:06pm UTC](https://discuss.kubernetes.io/t/nginx-ingress-kubernetes-io-auth-tls-verify-client-on-is-not-working/16170/1 "2021-06-04T13:06:20Z")
Hi everyone,
I have a problem.
I would like to create kubernetess ingress with the same behaviour as nginx:
ssl on;
ssl\_certificate /certs/server.crt;
ssl\_certificate\_key /certs/server.nopass.key;
ssl\_client\_certificate /certs/ca.crt;
ssl\_verify\_client on;
I use annotations:
[kubernetes.io/ingress.allow-http:](http://kubernetes.io/ingress.allow-http:) “false”
# Enable client certificate authentication
nginx.ingress.kubernetes .io/auth-tls-verify-client: “on”
# Create the secret containing the trusted ca certificates
nginx.ingress.kubernetes .io/auth-tls-secret: “default/ca-secret”
# Specify the verification depth in the client certificates chain
nginx.ingress.kubernetes .io/auth-tls-verify-depth: “1”
# Specify an error page to be redirected to verification errors
nginx.ingress.kubernetes .io/auth-tls-error-page: “[https://www.google.com](https://www.google.com)”
# Specify if certificates are passed to upstream server
nginx.ingress.kubernetes .io/auth-tls-pass-certificate-to-upstream: “true”
But, I can pass ingress with wrong client cert. I do not have the same behaviour as nginx provides.
Am I wrog anywhere or there is a bug on kubernetes side?
---
### Author:  [@Nick13](https://discuss.kubernetes.io/u/Nick13)
#### Post date: [June 6, 2021, 11:44am UTC](https://discuss.kubernetes.io/t/nginx-ingress-kubernetes-io-auth-tls-verify-client-on-is-not-working/16170/3 "2021-06-06T11:44:25Z")
Moreover, I see that one guy has the same issue: [google kubernetes engine - GKE Nginx Ingress - Setting host causes 400 No required SSL certificate - Stack Overflow](https://stackoverflow.com/questions/64430232/gke-nginx-ingress-setting-host-causes-400-no-required-ssl-certificate)
---
### Author:  [@Nick13](https://discuss.kubernetes.io/u/Nick13)
#### Post date: [June 6, 2021, 12:04pm UTC](https://discuss.kubernetes.io/t/nginx-ingress-kubernetes-io-auth-tls-verify-client-on-is-not-working/16170/4 "2021-06-06T12:04:05Z")
Seems the answer is here: [HTTPS consistangly gives Fake Kubernetes Certificate · Issue #1984 · kubernetes/ingress-nginx · GitHub](https://github.com/kubernetes/ingress-nginx/issues/1984) - we cannot use ip, only domain name… otherwise " you will be directed to the default server",- **[aledbf](https://github.com/aledbf)** commented [on 25 Jan 2018](https://github.com/kubernetes/ingress-nginx/issues/1984#issuecomment-360576158)
---
### Author:  [@Nick13](https://discuss.kubernetes.io/u/Nick13)
#### Post date: [June 6, 2021, 12:05pm UTC](https://discuss.kubernetes.io/t/nginx-ingress-kubernetes-io-auth-tls-verify-client-on-is-not-working/16170/5 "2021-06-06T12:05:51Z")
But Nginx can do that…
---
### Author:  [@Nick13](https://discuss.kubernetes.io/u/Nick13)
#### Post date: [June 6, 2021, 12:27pm UTC](https://discuss.kubernetes.io/t/nginx-ingress-kubernetes-io-auth-tls-verify-client-on-is-not-working/16170/6 "2021-06-06T12:27:39Z")
Guys I just added --no-check-certificate
wget --private-key ca.key --certificate ca.crt [http://34.134.253.193/](http://34.134.253.193/) --no-check-certificate
and all became working as expected:
1. correct answer on correct certs.
2. error redirect on any other certs .
---
### Author:  [@Nick13](https://discuss.kubernetes.io/u/Nick13)
#### Post date: [June 6, 2021, 12:34pm UTC](https://discuss.kubernetes.io/t/nginx-ingress-kubernetes-io-auth-tls-verify-client-on-is-not-working/16170/7 "2021-06-06T12:34:05Z")
_ **My current ingress nginx back-end:** _
kubectl apply -f [https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v0.46.0/deploy/static/provider/cloud/deploy.yaml](https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v0.46.0/deploy/static/provider/cloud/deploy.yaml)
_I generate certs using these commands_:
openssl req -new -newkey rsa:2048 -nodes -keyout ca.key -x509 -days 500 -subj /C=UA/ST=Kyiv/L=Kyiv/O=SomeOrg/OU=Nick/CN=34.134.253.193/emailAddress=murha .for .articles@gmail. com -out ca.crt
openssl genrsa -des3 -out server.key 2048
openssl req -new -key server.key -out server.csr
openssl x509 -req -days 365 -in server.csr -CA ca.crt -CAkey ca.key -set\_serial 01 -out server.crt
openssl rsa -in server.key -out server.nopass.key
_ **My secret generation command is** _:
kubectl create secret generic ca-secret --from-file=tls.crt=server.crt --from-file=tls.key=server.nopass.key --from-file=ca.crt=ca.crt
_ **And my current ingress yaml annotations are** _:
kubernetes .io/ingress.class: “nginx”
nginx. ingress. kubernetes. io/rewrite-target: /$1
# Enable client certificate authentication
nginx. [ingress.kubernetes.io/auth-tls-verify-client:](http://ingress.kubernetes.io/auth-tls-verify-client:) “on”
# Create the secret containing the trusted ca certificates
nginx. ingress. kubernetes .io/auth-tls-secret: “default/ca-secret”
# Specify the verification depth in the client certificates chain
nginx. [ingress.kubernetes.io/auth-tls-verify-depth:](http://ingress.kubernetes.io/auth-tls-verify-depth:) “3”
# Specify an error page to be redirected to verification errors
nginx. ingress. kubernetes .io/auth-tls-error-page: “[https://www.google.com](https://www.google.com)”
nginx. ingress .kubernetes .io/auth-tls-pass-certificate-to-upstream: “true”
nginx. ingress. kubernetes .io/force-ssl-redirect: “true”
_ **I appreciate your review, because I have to show these configs to client.** _