Description:

What issue is being seen? Describe what should be happening instead of
the bug, for example: Envoy should not crash, the expected value isn't
returned, etc.

When BackendTlsPolicy specify multiple targetRefs of the same service with different port, only the first one will work.

Repro steps:

Include sample requests, environment, etc. All data and inputs
required to reproduce the bug.

Note: If there are privacy concerns, sanitize the data prior to
sharing.

• start a service with 2 ports 8080 & 8081, and enable TLS with self-signed localhost certificate.
• create Gateway CR & 2 HTTPRoute CR for both ports.
• create ConfigMap my-ca with self-signed ca.crt.
• create BackendTLSPolicy

apiVersion: gateway.networking.k8s.io/v1alpha3
kind: BackendTLSPolicy
metadata:
  name: my-service
  namespace: default
spec:
  targetRefs:
  - group: ''
    kind: Service
    name: my-service
    sectionName: "8080"
  - group: ''
    kind: Service
    name: my-service
    sectionName: "8081"
  validation:
    caCertificateRefs:
    - name: my-ca
      group: ''
      kind: ConfigMap
    hostname: localhost

• curl gateway 8080 service with https, ok
• curl gateway 8081 service with https
• got following error:

Client sent an HTTP request to an HTTPS server.

Environment:

Include the environment like gateway version, envoy version and so on.

gateway: v1.1.0

Logs:

Include the access logs and the Envoy logs.