AKS Istio Ingress gateway Certificate is not valid

Question

I have an AKS cluster with Istio install and I'm trying to deploy a containerised web api with TLS.

The api runs and is accessible but is showing as Not secure.

I have followed the directions on istios website to set this so not sure what I've missed.

I have created the secret with the command

kubectl create secret tls mycredential -n istio-system --key mycert.key --cert mycert.crt

and setup a gateway as follows

apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: my-gateway
  namespace: mynamespace
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    tls:
      mode: SIMPLE
      credentialName: mycredential # must be the same as secret
    hosts:
    - 'dev.api2.mydomain.com'

The following virtual service

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: myapi
  namespace: mynamespace
spec:
  hosts:
  - "dev.api2.mydomain.com"
  gateways:
  - my-gateway
  http:
  - match:
    - uri:
        prefix: "/myendpoint"
    rewrite:
      uri: " "
    route:
    - destination:
        port:
          number: 8080
        host: myapi

and service

apiVersion: v1
kind: Service
metadata:
  name: myapi
  namespace: mynamespace
  labels:
    app: myapi
    service: myapi
spec:
  ports:
    - name: http
      port: 8080
      targetPort: 80
  selector:
    app: myapi

The container exposes port 80

Can someone please point me in the right direction because I'm not sure what I've done wrong

Answer 1

I managed to resolve the issue by setting up cert manager and pointing it at letsencrypt to generate the certificate, rather than using the pre-purchased one I was trying to add manually.

Although it took some searching to find how to correctly configure this, it is now working and actually saves having to purchase certificates, so win win :)