Skip to content
Products
Platform
Developer Tools
Portal

Ensure RFC-compliant API requests to your SKE cluster

Last updated on

Our SKE ingress mechanism strictly enforces RFC compliance. Clients whose TLS Server Name Indication (SNI) does not match the HTTP Host or :authority header are rejected. This guide explains how to make sure your clients stay compatible.

Relevant RFCs

Section titled “Relevant RFCs”

If the Host or :authority header does not match the server_name in the TLS client hello, the SKE Ingress configuration treats it as a connection coalescing attempt, and the server responds with 421 Misdirected Request.

This affects clients that send, for example, localhost in the Host header when connecting to the SKE cluster API server. Such clients do not expect this status code and fail, whereas a browser would typically open a new connection with a matching server_name in the TLS client hello.

The following RFCs describe the expected client behavior:

RFC 6066 (TLS Extensions)

  • Section 3: Defines Server Name Indication (SNI) sent during the TLS handshake.

RFC 9110 (HTTP Semantics)

  • Section 7.2: Describes target host headers (Host and :authority) and forbids conflicting values.
  • Section 7.4: Describes rejecting requests where the underlying TLS connection is not authoritative for the HTTP target host.
  • Section 15.5.20: Defines the 421 Misdirected Request status code, which signals clients to open a new connection.

What you need to do

Section titled “What you need to do”

We highly encourage you to check your clients for strict RFC conformance. Known examples of incompatible clients that may require updates or configuration changes include:

  • Rancher
  • Pinniped
  • vCluster
  • Dex
  • specific proxy configurations

To verify and fix your clients:

  1. Identify the tools, SDKs, scripts, and proxies that connect to your cluster’s API endpoint, for example, CI/CD pipelines, management tools, and external integrations.

  2. Inspect their client-side configuration and proxy logs for custom Host or :authority header overrides.

  3. Reconfigure any affected client so that the HTTP Host or :authority header matches the TLS SNI hostname of your API endpoint.