phase (VM/bare-metal Machines Scenario)</h3><ol><li><p>Istio CA creates a gRPC service to take CSR request.</p></li><li><p>Node agent creates the private key and CSR, sends the CSR to Istio CA for signing.</p></li><li><p>Istio CA validates the credentials carried in the CSR, and signs the CSR to generate the certificate.</p></li><li><p>Node agent puts the certificate received from CA and the private key to Envoy.</p></li><li><p>The above CSR process repeats periodically for rotation.</p></li></ol><h3 id="ru