the Istio proxies for mTLS.</p><pre><code class=language-bash data-expandlinks=true data-repo=istio>$ istioctl pc secret &lt;pod-name&gt; -o json &gt; proxy_secret
</code></pre></li></ol><p>The <code>proxy_secret</code> json file contains the CA root certificate for mTLS in the <code>trustedCA</code> field. Note that this certificate is base64 encoded.</p><ol><li><p>Compare the CA root certificate obtained in the step above with &ldquo;root-cert.pem&rdquo; value in external-ca-cert. These two should be the 