Get 400 No required SSL certificate was sent when installing signserver

[quyen66]

I install signserver with helm and k8s following this tutorial https://www.youtube.com/watch?v=nntAbPvxQAg&t=2s. Before that, I created TLS server https://doc.primekey.com/ejbca/tutorials-and-guides/tutorial-issue-tls-server-certificates-with-ejbca with managementCA to issue tls server for signserver with rsa, but when I acccess the web it return me 400.

Here my signserver.yaml

signserver:
  useEphemeralH2Database: false
  useH2Persistence: false
  env:
    DATABASE_JDBC_URL: jdbc:mariadb://mariadb:3306/signserverdb?characterEncoding=UTF-8
    DATABASE_USER: "signserver"
    DATABASE_PASSWORD: "ejbca"

services:
  directHttp:
    enabled: false
    type: NodePort
    httpPort: 31080
    httpsPort: 31443
  proxyAJP:
    enabled: true
    type: ClusterIP
    bindIP: 0.0.0.0
    port: 8009
  proxyHttp:
    enabled: false
    type: ClusterIP
    bindIP: 0.0.0.0
    httpPort: 8081
    httpsPort: 8082

ingress:
  enabled: true
  className: "nginx"
  annotations:
    ## Do not redirect HTTP to HTTPS
    nginx.ingress.kubernetes.io/ssl-redirect: "false"
    ## Enable optional client certificate authentication
    nginx.ingress.kubernetes.io/auth-tls-verify-client: "on"
    ## Secret containing trusted CA certificates
    nginx.ingress.kubernetes.io/auth-tls-secret: "default/managementca-secret"
    ## Pass client certificates to upstream server
    nginx.ingress.kubernetes.io/auth-tls-pass-certificate-to-upstream: "true"

  hosts:
    - host: "ejbca-node1.ejbca-k8s"
      paths:
        - path: /signserver
          pathType: Prefix
  tls:
    - hosts:
       - ejbca-node1.ejbca-k8s
      secretName: ingress-tls

replicaCount: 1

image:
  repository: keyfactor/signserver-ce
  pullPolicy: IfNotPresent

imagePullSecrets: []
nameOverride: ""
fullnameOverride: ""

serviceAccount:
  # Specifies whether a service account should be created
  create: true
  # Annotations to add to the service account
  annotations: {}
  # The name of the service account to use.
  # If not set and create is true, a name is generated using the fullname template
  name: ""

podAnnotations: {}

podSecurityContext: {}

securityContext: {}

resources: {}

autoscaling:
  enabled: false
  minReplicas: 1
  maxReplicas: 5
  targetCPUUtilizationPercentage: 80
  # targetMemoryUtilizationPercentage: 80

nodeSelector: {}

tolerations: []

affinity: {}

I also add ingress.key, ingress.crt, managementca.crt into k8s.