<p>Since we are using ISTIO as Ingress Gateway with Kubernetes, the issue is related to ISTIO gateway config.
We simply had to replace the matching host to '*' in ISTIO gateway config</p>

CC BY-SA 4.0
2020-08-04T11:24:25.493Z
2020-08-04T11:24:25.493Z
Abba
<p>We have an ODBC Driver trying to connect through TLS , but fails.
We tested using openssl with the following command and worked fine:</p>
<blockquote>
<p>openssl s_client -connect xxx.com:31020</p>
</blockquote>
<p>the server accepts TLS 1.0 to TLS 1.3 (downgraded just for debugging)</p>
<p>While Trying to connect , here is the wireshark handshake capture flow:</p>
<p><a href="https://i.sstatic.net/ACOh6.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/ACOh6.png" alt="enter image description here" /></a></p>
<p>and also while expanding the client hello TLS, this is what we have :</p>
<p><a href="https://i.sstatic.net/J91mc.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/J91mc.png" alt="enter image description here" /></a></p>
<p>Any idea what's causing the handshake not to start properly?</p>

<security><ssl><istio>
TLS handshake failure
Abba
# TLS handshake failure

(Asked by: username_0 on 2020-07-17)

We have an ODBC Driver trying to connect through TLS , but fails.
We tested using openssl with the following command and worked fine:

> openssl s\_client -connect xxx.com:31020

the server accepts TLS 1.0 to TLS 1.3 (downgraded just for debugging)

While Trying to connect , here is the wireshark handshake capture flow:

[![enter image description here](https://i.sstatic.net/ACOh6.png)](https://i.sstatic.net/ACOh6.png)

and also while expanding the client hello TLS, this is what we have :

[![enter image description here](https://i.sstatic.net/J91mc.png)](https://i.sstatic.net/J91mc.png)

Any idea what's causing the handshake not to start properly?

**Tags:** security, ssl, istio


---

## 1 answers

### Answer by username_0 on 2020-08-04. Score: 1 | Accepted answer

Since we are using ISTIO as Ingress Gateway with Kubernetes, the issue is related to ISTIO gateway config.
We simply had to replace the matching host to '\*' in ISTIO gateway config


---

