atings-v1-734492171-rnr5l -c istio-proxy -- /bin/cat /etc/certs/cert-chain.pem &gt; /tmp/pod-cert-chain.pem
</code></pre><p>The file <code>/tmp/pod-cert-chain.pem</code> should contain the workload certificate and the CA certificate.</p></li><li>Verify the root certificate is the same as the one specified by operator:<pre><code class="language-bash">openssl x509 -in /tmp/root-cert.pem -text -noout &gt; /tmp/root-cert.crt.txt
openssl x509 -in /tmp/pod-root-cert.pem -text -noout &gt; /tmp/pod-root-cert.crt.tx