ion cluster setup, it is highly recommended to use a production-ready CA, such as
<a href=https://www.hashicorp.com/products/vault>Hashicorp Vault</a>.
It is a good practice to manage the root CA on an offline machine with strong
security protection.</div></aside></div><ol><li><p>In the top-level directory of the Istio installation package, create a directory to hold certificates and keys:</p><pre><code class=language-bash data-expandlinks=true data-repo=istio>$ mkdir -p certs
$ pushd certs
</code></pre></l