li><li>make sure the key/cert is in /etc/certs/ directory<pre><code class="language-bash">ls /etc/certs/ 
</code></pre><pre><code class="language-bash">cert-chain.pem   key.pem   root-cert.pem
</code></pre><p>Note that cert-chain.pem is envoy’s cert that needs to present to the other side. key.pem is envoy’s private key paired with cert-chain.pem. root-cert.pem is the root cert to verify the other side’s cert. Currently we only have one CA, so all envoys have the same root-cert.pem.</p></li><li>send r