ssl-certificate | A class to validate SSL certificates | TLS library

There is a library called cryptography which can do exactly this:

We decided to go with Certificates that are purchased on the Azure portal itself. It just not forth our time to figure it out.

This link can help you with KV add-on certificate on App GW: https://azure.github.io/application-gateway-kubernetes-ingress/features/appgw-ssl-certificate/

I use different configuration to set certs on Appgw.

1. I'm getting certificates via the akv2k8s tool. This creates secrets on k8s cluster.
2. Then I use those certs in the ingress configuration. Please check tls definition under spec.

You need to change "rsa:4096" to "rsa:2048" then ran the first command again:

Please, be aware that the cipher suites described in your debug output doesn't show the cipher suite that was actually used by openssl, ECDHE-RSA-AES256-GCM-SHA384. In fact, they don't include any cipher suite that requires AES 256. It may not be of relevance, but it may be a symptom of any misconfiguration, and can explain why the handshake is failing. As indicated in the Oracle documentation when describing Java 8 supported cipher suites:

Cipher suites that use AES_256 require installation of the JCE Unlimited Strength Jurisdiction Policy Files.

As a consequence, please, be sure you installed and properly configured the JCE Unlimited Strength Jurisdiction Policy Files.

As indicated by @dave_thompson_085 in his excellent comment, only Oracle Java 8 below 8u161 requires adding the unlimited policy, as stated in Appendix C of the aforementioned Oracle documentation.

The JCE Unlimited Strength Jurisdiction Policy Files are bundled into the JDK since JDK 8u151, but the unlimited policy was not defined as the default one since JDK 8u161.

In JDK 8u151 or 8u152, as stated in one of the previous cited links, and explained as well by @dave_thompson_085 - thank you very much again, in order to make the unlimited version of the JCE the one that should be used, you need to define the system property crypto.policy. From the docs:

This release introduces a new feature whereby the JCE jurisdiction policy files used by the JDK can be controlled via a new Security property. In older releases, JCE jurisdiction files had to be downloaded and installed separately to allow unlimited cryptography to be used by the JDK. The download and install steps are no longer necessary. To enable unlimited cryptography, one can use the new crypto.policy Security property. If the new Security property (crypto.policy) is set in the java.security file, or has been set dynamically by using the Security.setProperty() call before the JCE framework has been initialized, that setting will be honored. By default, the property will be undefined. If the property is undefined and the legacy JCE jurisdiction files don't exist in the legacy lib/security directory, then the default cryptographic level will remain at 'limited'. To configure the JDK to use unlimited cryptography, set the crypto.policy to a value of 'unlimited'. See the notes in the java.security file shipping with this release for more information.

The issue is not present in OpenJDK.

As an alternative solution, as suggested in this related SO question, probably using an alternate provider like BouncyCastle could be of help as well.

WORKING NOW WITH FOLLOWING CONFIG

According to Google Kubernetes Engine (GKE) official documentation here, you are able to customize ingress/Level 7 Load Balancer health checks through either:

• the readinessProbe for the container within the pod your ingress is serving traffic to

  Warning: this method comes with warnings here

• a backendconfig resource

I would highly recommend creating a backendconfig resource.

Unfortunately, the kubernetes Terraform provider does not seem to support the backendconfig resource based on this GitHub issue. This means that you can either:

• use the kubernetes-alpha provider (found here) to transcribe a YAML backendconfig manifest to HCL with the manifest argument for the only kubernetes-alpha resource: kubernetes-manifest (more on that here)
• use an unofficial provider (such as banzaicloud/k8s found here)
• check the backendconfig manifest (as either JSON or YAML) into SCM

A sample backendconfig YAML manifest:

Finally I was able to resolve the issue as follows:

I've found the following documentation:

Setting up certificates for Azure CLI on Azure Stack Development Kit

The basic idea is to find the python installation used for Azure CLI and update the related certificate file.

In my case the Azure CLI was installed with python on the following location:

C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\python.exe

And using the command, that was suggested, returned as follows:

Picking up on the comment by @salparadise, the following worked for me: