TLS handshake error

Hello,
I deployed HF on Kubernetes with ORDERER_GENERAL_TLS_ENABLED and ORDERER_GENERAL_TLS_CLIENTAUTHREQUIRED set to true. Everything works fine, I can create, join the channel, install and invoke chaincode but logs are keep reporting errors:

peer:

2021-09-21 04:56:23.244 UTC [core.comm] ServerHandshake -> ERRO 3592 TLS handshake failed with error EOF server=PeerServer remoteaddress=10.0.1.43:39723
2021-09-21 04:56:23.730 UTC [core.comm] ServerHandshake -> ERRO 3593 TLS handshake failed with error EOF server=PeerServer remoteaddress=10.0.3.79:16171
2021-09-21 04:56:33.245 UTC [core.comm] ServerHandshake -> ERRO 3594 TLS handshake failed with error EOF server=PeerServer remoteaddress=10.0.1.43:53561
2021-09-21 04:56:33.730 UTC [core.comm] ServerHandshake -> ERRO 3595 TLS handshake failed with error EOF server=PeerServer remoteaddress=10.0.3.79:23402
2021-09-21 04:56:43.245 UTC [core.comm] ServerHandshake -> ERRO 3596 TLS handshake failed with error EOF server=PeerServer remoteaddress=10.0.1.43:31386
2021-09-21 04:56:43.730 UTC [core.comm] ServerHandshake -> ERRO 3597 TLS handshake failed with error EOF server=PeerServer remoteaddress=10.0.3.79:56648
2021-09-21 04:56:53.244 UTC [core.comm] ServerHandshake -> ERRO 3598 TLS handshake failed with error EOF server=PeerServer remoteaddress=10.0.1.43:24813
2021-09-21 04:56:53.730 UTC [core.comm] ServerHandshake -> ERRO 3599 TLS handshake failed with error EOF server=PeerServer remoteaddress=10.0.3.79:16606

ordered:

2021-09-21 04:57:23.444 UTC [core.comm] ServerHandshake -> ERRO 358a TLS handshake failed with error EOF server=Orderer remoteaddress=10.0.3.79:16379
2021-09-21 04:57:26.715 UTC [core.comm] ServerHandshake -> ERRO 358b TLS handshake failed with error EOF server=Orderer remoteaddress=10.0.1.43:3286
2021-09-21 04:57:33.444 UTC [core.comm] ServerHandshake -> ERRO 358c TLS handshake failed with error EOF server=Orderer remoteaddress=10.0.3.79:53327
2021-09-21 04:57:36.715 UTC [core.comm] ServerHandshake -> ERRO 358d TLS handshake failed with error EOF server=Orderer remoteaddress=10.0.1.43:20585
2021-09-21 04:57:43.444 UTC [core.comm] ServerHandshake -> ERRO 358e TLS handshake failed with error EOF server=Orderer remoteaddress=10.0.3.79:39147
2021-09-21 04:57:46.714 UTC [core.comm] ServerHandshake -> ERRO 358f TLS handshake failed with error EOF server=Orderer remoteaddress=10.0.1.43:9662
2021-09-21 04:57:53.445 UTC [core.comm] ServerHandshake -> ERRO 3590 TLS handshake failed with error EOF server=Orderer remoteaddress=10.0.3.79:18608
2021-09-21 04:57:56.714 UTC [core.comm] ServerHandshake -> ERRO 3591 TLS handshake failed with error EOF server=Orderer remoteaddress=10.0.1.43:63920

ca:

2021/09/21 04:58:02 http: TLS handshake error from 10.0.1.43:34865: EOF
2021/09/21 04:58:08 http: TLS handshake error from 10.0.3.79:26766: EOF
2021/09/21 04:58:12 http: TLS handshake error from 10.0.1.43:54927: EOF
2021/09/21 04:58:18 http: TLS handshake error from 10.0.3.79:7199: EOF
2021/09/21 04:58:22 http: TLS handshake error from 10.0.1.43:38316: EOF
2021/09/21 04:58:28 http: TLS handshake error from 10.0.3.79:49130: EOF
2021/09/21 04:58:32 http: TLS handshake error from 10.0.1.43:56355: EOF

I have set fully qualified domain names in env vars like:

    - name: ORDERER_HOST
      value: orderer-1.mydomain.com

and in configtx.yaml:

     OrdererEndpoints:
         - orderer-1.mydomain.com:7050
         - orderer-2.mydomain.com:7050
         - orderer-3.mydomain.com:7050

...

     AnchorPeers:
         # AnchorPeers defines the location of peers which can be used
         # for cross org gossip communication.  Note, this value is only
         # encoded in the genesis block in the Application section context
         - Host: peer-1.mydomain.com
           Port: 7051
         - Host: peer-2.mydomain.com
           Port: 7051
         - Host: peer-3.mydomain.com
           Port: 7051

Certificates are generated as:

fabric-ca-client enroll -u https://ca-admin:$PASSWORD@ca-mydomain.mydomain.com:7054 --caname ca-mydomain.mydomain.com --tls.certfiles /var/fabric/ca/home/tls-cert.pem

fabric-ca-client register -u https://ca-admin:$PASSWORD@ca-mydomain.mydomain.com:7054 --caname ca-mydomain.mydomain.com --id.name orderer-1 --id.secret $PASSWORD --id.affiliation mydomain --id.type orderer --tls.certfiles /var/fabric/ca/home/tls-cert.pem

fabric-ca-client register -u https://ca-admin:$PASSWORD@ca-mydomain.mydomain.com:7054 --caname ca-mydomain.mydomain.com --id.name peer-1 --id.secret $PASSWORD --id.affiliation mydomain --id.type peer --tls.certfiles /var/fabric/ca/home/tls-cert.pem

Service discovery looks good:

# discover --configFile discovery-conf.yaml config --channel mydomainchannel --server peer-1.mydomain.com:7051
{
"msps": {
"OrdererMSP": {
"name": "OrdererMSP",
"root_certs": [
"XXXXXXXXXXXX="
],
"crypto_config": {
"signature_hash_family": "SHA2",
"identity_identifier_hash_function": "SHA256"
},
"tls_root_certs": [
"XXXXXXXXXXXX="
],
"fabric_node_ous": {
"enable": true,
"client_ou_identifier": {
"certificate": "XXXXXXXXXXXX=",
"organizational_unit_identifier": "client"
},
"peer_ou_identifier": {
"certificate": "XXXXXXXXXXXX=",
"organizational_unit_identifier": "peer"
},
"admin_ou_identifier": {
"certificate": "XXXXXXXXXXXX=",
"organizational_unit_identifier": "admin"
},
"orderer_ou_identifier": {
"certificate": "XXXXXXXXXXXX=",
"organizational_unit_identifier": "orderer"
}
}
},
"mydomainMSP": {
"name": "mydomainMSP",
"root_certs": [
"XXXXXXXXXXXX="
],
"crypto_config": {
"signature_hash_family": "SHA2",
"identity_identifier_hash_function": "SHA256"
},
"tls_root_certs": [
"XXXXXXXXXXXX="
],
"fabric_node_ous": {
"enable": true,
"client_ou_identifier": {
"certificate": "XXXXXXXXXXXX=",
"organizational_unit_identifier": "client"
},
"peer_ou_identifier": {
"certificate": "XXXXXXXXXXXX=",
"organizational_unit_identifier": "peer"
},
"admin_ou_identifier": {
"certificate": "XXXXXXXXXXXX=",
"organizational_unit_identifier": "admin"
},
"orderer_ou_identifier": {
"certificate": "XXXXXXXXXXXX=",
"organizational_unit_identifier": "orderer"
}
}
}
},
"orderers": {
"OrdererMSP": {
"endpoint": [
{
"host": "orderer-1.mydomain.com",
"port": 7050
},
{
"host": "orderer-2.mydomain.com",
"port": 7050
},
{
"host": "orderer-3.mydomain.com",
"port": 7050
}
]
}
}
}

How to get rid of these errors?
IPs 10.0.3.79, 10.0.1.43 are not defined anywhere, they are not pods' ips, ports are random.