ficate for Istio workloads.</p><p>In this example, because the Istio CA certificate (<code class="highlighter-rouge">ca-cert.pem</code>) is not set as the workloads’ root certificate (<code class="highlighter-rouge">root-cert.pem</code>), the workload cannot validate the workload certificates directly from the root certificate. The workload needs a <code class="highlighter-rouge">cert-chain.pem</code> file to specify the chain of trust, which should include the certificates of all the intermediate CAs bet