Study. uk . com
  1. Home
  2. All questions
  3. Question 705

CKA study material · question 705 of 1000

An application reaching an HTTPS backend through an ExternalName Service gets certificate errors. What explains this?

  1. The client connects using the in-cluster name, which the origin's certificate does not cover
  2. ExternalName Services terminate TLS at the cluster edge
  3. The CNAME record strips the SNI extension
  4. kube-proxy re-encrypts the connection with the cluster CA
Show the answer

Answer: A. The client connects using the in-cluster name, which the origin's certificate does not cover

With ExternalName the hostname the client uses differs from the one the Service references, so TLS servers cannot present a matching certificate and HTTP servers see an unfamiliar Host header.

Source: Service (Kubernetes) — Service type › type: ExternalName

Challenge yourself on this topic → Study as cards