In the cluster, a Secret has already been added or modified, and the secretName is specified in the Ingress. However, the default or old certificate is still used for cluster access, and the newly configured certificate does not take effect.

Cause analysis

The certificate is not returned by the Ingress Controller within the cluster.

The certificate is invalid and fails to be loaded correctly by the Controller.

The Ingress Controller returns the corresponding certificate based on Server Name Indication (SNI), but the SNI field may not be carried during the TLS handshake.

Solution

Verify whether the SNI field is carried when establishing a TLS connection. That means you need to check whether the certificate is loaded normally and returned to the client correctly. You can follow the steps below:

Use a newer browser version that supports SNI.

When testing the certificate using the openssl s_client command, include the -servername parameter.

Execute the following command via kubectl to manually check the Ingress pod error log and make modifications based on the log details.

kubectl logs <ingress pod name> -n <pod namespace> | grep -E ^[EW]

Last updated: 2026.03.31 10:58:08

Public security network record in Beijing: No. 11010802032137