TLS Fails When Kubernetes Service port and container port not the same

[haykhovsepyan]

Describe the bug
when mTLS is enabled in App Mesh and the Kubernetes Service port is different from targetPort:

curl nginx.staging.svc.cluster.local:8080 upstream connect error or disconnect/reset before headers. retried and the latest reset reason: remote connection failure, transport failure reason: TLS_error:|268435703:SSL routines:OPENSSL_internal:WRONG_VERSION_NUMBER:TLS_error_end:TLS_error_end

Steps to reproduce

The container listens on port 80

The Kubernetes Service is defined as:

ports:
  - port: 8080         # Service port
    targetPort: 80     # Container port

The VirtualNode is configured with listener.port: 8080 (matching the Service port)

apiVersion: appmesh.k8s.aws/v1beta2
kind: VirtualNode
metadata:
  name: nginx
  namespace: staging
  resourceVersion: "283618886"
  uid: fd4edc8b-324c-4136-b289-330c100ac762
spec:
  awsName: nginx_staging
  backendDefaults:
    clientPolicy:
      tls:
        enforce: false
        validation:
          trust:
            file:
              certificateChain: /meshcerts/ca.crt
  backends:
  - virtualService:
      virtualServiceRef:
        name: service-backend
  listeners:
  - portMapping:
      port: 8080
      protocol: http
    tls:
      certificate:
        file:
          certificateChain: /meshcerts/tls.crt
          privateKey: /meshcerts/tls.key
      mode: PERMISSIVE
  meshRef:
    name: staging-mesh
  podSelector:
    matchLabels:
      app.kubernetes.io/instance: staging
      app.kubernetes.io/name: nginx
  serviceDiscovery:
    dns:
      hostname: nginx.staging.svc.cluster.local

When I changing container port to 8080 as well everything works pretty good with tls.

Expected outcome
A concise description of what you expected to happen.

Environment

• App Mesh controller version: v1.13.1
• Envoy image version: aws-appmesh-envoy:v1.29.6.0-prod
• Are you using any integrations? X-ray, Jaeger etc. If so versions?
• EKS Fargate cluster v1.30.13

Additional Context:

[davolia]

We have the same issue. Any solution?