bad certificate for dashboard

[shakenfr]

In tag 4.12.0

I use generate_certs.sh in dashbord folder and in indexer folder to use seft signed certificates

after I do a kubectl apply -k envs/local-env/

I obtain

wazuh-dashboard-6ff84ccc66-j8szv 1/1 Running 0 7m32s
wazuh-indexer-0 1/1 Running 0 8m49s
wazuh-manager-master-0 1/1 Running 0 7m1s
wazuh-manager-worker-0 1/1 Running 0 8m49s

I seems ok but when I try to access to the dashbord through ingress, I have this logs inside the dashboard pod

{"type":"error","@timestamp":"2025-06-12T08:43:22Z","tags":["connection","client","error"],"pid":54,"level":"error","error":{"message":"00E8B147B87B0000:error:0A000412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1586:SSL alert number 42\n","name":"Error","stack":"Error: 00E8B147B87B0000:error:0A000412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1586:SSL alert number 42\n","code":"ERR_SSL_SSLV3_ALERT_BAD_CERTIFICATE"},"message":"00E8B147B87B0000:error:0A000412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate:../deps/openssl/openssl/ssl/record/rec_layer_s3.c:1586:SSL alert number 42\n"}

any idea ?

best
bruno

[shakenfr]

service are

NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
dashboard LoadBalancer 10.106.158.95 443:31489/TCP 4h12m
indexer LoadBalancer 10.97.64.205 9200:31405/TCP 4h12m
wazuh LoadBalancer 10.101.206.58 1515:31066/TCP,55000:32009/TCP 4h12m
wazuh-cluster ClusterIP None 1516/TCP 4h12m
wazuh-indexer ClusterIP None 9300/TCP 4h12m
wazuh-workers LoadBalancer 10.110.187.33 1514:30533/TCP 4h12m

a curl -k https://localhost:31489 -vvv. tells me

< HTTP/1.1 302 Found
< location: /app/login?

so It seems ok

I create in ingress, the ingress works because I obtain the certificate error on logs of the pod

The service has an endpoint

Port: dashboard 443/TCP
TargetPort: 5601/TCP
NodePort: dashboard 31489/TCP
Endpoints: 10.96.220.134:5601

but from the outside it's an "internal server error" with the log provided in post n°1

any idea ?