The way ingress works, it matches the request based on the hostname in the http request or TLS SNI header. So if you are making requests against the node, it’s not going to serve you the cert or content for rancher - because you’re not making a connection and request against the hostname configured for the Rancher ingress. You’re making a connection and request against the node.

Mind you this is my first Rancher HA installation.

At present, I do not have evidence that my Load Balancer is working, hence my trying to backtrack.

you just want it to pass TCP traffic directly to the nodes or pods

Since I have been having problems getting anything on my load balancer, I presently have the config scaled back to only my-rancher-1 ...

worker_processes 4;
worker_rlimit_nofile 40000;

events {
    worker_connections 8192;
}

http {
    upstream rancher {
        server <http://my-rancher-1.my.org:80;|my-rancher-1.my.org:80;>
    }

    map $http_upgrade $connection_upgrade {
        default Upgrade;
        ''      close;
    }

    server {
        listen 443 ssl http2;
        server_name <http://my-rancher-1.my.org|my-rancher-1.my.org>;
        ssl_certificate /etc/pki/nginx/my-rancher-chain.cer;
        ssl_certificate_key /etc/pki/nginx/private/my-rancher.key;

        location / {
            proxy_set_header Host $host;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Forwarded-Port $server_port;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_pass <http://rancher>;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            # This allows the ability for the execute shell window to remain open for up to 15 minutes. Without this parameter, the default is 1 minute and will automatically close.
            proxy_read_timeout 900s;
            proxy_buffering off;
        }
    }

    server {
        listen 80;
        server_name <http://my-rancher-1.my.org|my-rancher-1.my.org>;
        return 301 https://$server_name$request_uri;
    }
}

you’re offloading everything to your nginx lb and trying to send the Rancher ingress only paintext traffic on port 80?

You want a super simple TCP load balancer that sends 80 to 80 and 443 to 443 without mucking with anything.

(I think that was the first config I tried.)