title: nginx-ingress controller for Azure Kubernetes Service 502 Bad Gateway
body: <p>I'm having trouble getting an nginx-ingress controller to work on an Azure Kubernetes Service; it's currently returning 502 Bad Gateway each time I try to hit some Web APIs exposed as Services.
  Because I must use an existing certificate, I followed <a href="https://docs.microsoft.com/en-us/azure/aks/ingress-own-tls" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/azure/aks/ingress-own-tls</a> to set up the controller and have followed <a href="https://www.markbrilman.nl/2011/08/howto-convert-a-pfx-to-a-seperate-key-crt-file/" rel="nofollow noreferrer">https://www.markbrilman.nl/2011/08/howto-convert-a-pfx-to-a-seperate-key-crt-file/</a> to generate a cert and key from a PFX (how the certificate was exported from an Azure Key Vault). I created the secret "aks-ingress-tls" using the certificate including the intermediate and root ceritficates and the decrypted key file.
  I have a YAML file to create a deployment, a service to expose it, and an ingress to route to it. Applying this YAML I can access the services via their IP addresses in HTTP, but using HTTPS to the Ingress Controller's EXTERNAL_IP always gives the 502 error.
  My YAML File (redacted):</p>
  
  <pre><code>---
  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: my-api
  spec:
    strategy:
      type: Recreate
    selector:
      matchLabels:
        app: my-api
    replicas: 3
    template:
      metadata:
        labels:
          app: my-api
      spec:
        containers:
        - name: my-api
          image: [REDACTED]/my-api:1.0
          ports:
          - containerPort: 443
          - containerPort: 80
        imagePullSecrets: 
        - name: data-creds
  ---
  apiVersion: v1
  kind: Service
  metadata:
    name: my-service
    labels:
      app: my-service
  spec:
    ports:
    - name: https
      port: 443
      targetPort: 443
      protocol: TCP
    - name: http
      port: 80
      targetPort: 80
      protocol: TCP
    selector:
      app: my-api
    type: LoadBalancer
  ---
  apiVersion: extensions/v1beta1
  kind: Ingress
  metadata:
    name: api-ingress
    annotations:
      kubernetes.io/ingress.class: nginx
      nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
      nginx.ingress.kubernetes.io/rewrite-target: /
      nginx.ingress.kubernetes.io/ssl-redirect: "false"
  spec:
    tls:
    - hosts: 
      - [REDACTED].co.uk
      secretName: aks-ingress-tls
    rules:
    - host: [REDACTED].co.uk
      http:
        paths:
        - path: /
          backend:
            serviceName: my-service
            servicePort: 443
  </code></pre>
  
  <p>I added a record to my hosts file (I'm on Windows so can't use curl's --resolve) to map [REDACTED].co.uk to the ingress controller's EXTERNAL_IP so I can try accessing it. That's when I get the errors.
  A <code>curl -v https://[REDACTED].co.uk</code> gives this: </p>
  
  <pre><code>VERBOSE: GET https://[REDACTED].co.uk/ with 0-byte payload
  curl : The request was aborted: Could not create SSL/TLS secure channel.
  At line:1 char:1
  + curl -v https://[REDACTED].co.uk
  + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      + CategoryInfo          : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-WebRequest], WebException
      + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand
  </code></pre>
  
  <p>Looking at logs for one of the ingress controller's pods:</p>
  
  <pre><code>10.244.1.1 - [10.244.1.1] - - [25/Apr/2019:13:39:20 +0000] "GET / HTTP/2.0" 502 559 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.103 Safari/537.36" 10 0.001 [default-sub360-auth-service-443] 10.244.1.254:443, 10.244.1.3:443, 10.244.1.4:443 0, 0, 0 0.000, 0.000, 0.000 502, 502, 502 e44e21c8a2f61f5137c9afdfc64c6584
  2019/04/25 13:39:20 [error] 1622#1622: *1127096 connect() failed (111: Connection refused) while connecting to upstream, client: 10.244.1.1, server: [REDACTED].co.uk, request: "GET /favicon.ico HTTP/2.0", upstream: "https://10.244.1.254:443/favicon.ico", host: "[REDACTED].co.uk", referrer: "https://[REDACTED].co.uk/"
  2019/04/25 13:39:20 [error] 1622#1622: *1127096 connect() failed (111: Connection refused) while connecting to upstream, client: 10.244.1.1, server: [REDACTED].co.uk, request: "GET /favicon.ico HTTP/2.0", upstream: "https://10.244.1.3:443/favicon.ico", host: "[REDACTED].co.uk", referrer: "https://[REDACTED].co.uk/"
  2019/04/25 13:39:20 [error] 1622#1622: *1127096 connect() failed (111: Connection refused) while connecting to upstream, client: 10.244.1.1, server: [REDACTED].co.uk, request: "GET /favicon.ico HTTP/2.0", upstream: "https://10.244.1.4:443/favicon.ico", host: "[REDACTED].co.uk", referrer: "https://[REDACTED].co.uk/"
  10.244.1.1 - [10.244.1.1] - - [25/Apr/2019:13:39:20 +0000] "GET /favicon.ico HTTP/2.0" 502 559 "https://[REDACTED].co.uk/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.103 Safari/537.36" 26 0.000 [default-sub360-auth-service-443] 10.244.1.254:443, 10.244.1.3:443, 10.244.1.4:443 0, 0, 0 0.000, 0.000, 0.004 502, 502, 502 63b6ed4414bf32694de3d136f7f277aa
  </code></pre>
  
  <p>Can anyone point me to what I need to look at or do to get this working now?</p>