>kubectl create secret generic cacerts -n istio-system --from-file=/tmp/ca-cert.pem --from-file=/tmp/ca-key.pem \
--from-file=/tmp/root-cert.pem --from-file=/tmp/cert-chain.pem
</code></pre></li><li>Redeploy the Istio CA, which reads the certificates and key from the secret-mount files:<pre><code class="language-bash">kubectl apply -f install/kubernetes/istio-ca-plugin-certs.yaml
</code></pre></li><li>To make sure the workloads obtain the new certificates promptly, delete the secrets generated by Istio CA (