he <code>istiod</code> pod.</p><pre><code class=language-bash data-expandlinks=true data-repo=istio>$ kubectl get mutatingwebhookconfiguration istio-sidecar-injector -o yaml -o jsonpath=&#39;{.webhooks[0].clientConfig.caBundle}&#39; | md5sum
4b95d2ba22ce8971c7c92084da31faf0  -
$ kubectl -n istio-system get configmap istio-ca-root-cert -o jsonpath=&#39;{.data.root-cert\.pem}&#39; | base64 -w 0 | md5sum
4b95d2ba22ce8971c7c92084da31faf0  -
</code></pre><p>The CA certificate should match. If they do not, restar