h3><ol><li><p>Load the secret into the istiod namespace.</p><pre><code class=language-bash data-expandlinks=true data-repo=istio>$ cat &lt;&lt;EOF &gt; ./external-ca-secret.yaml
  apiVersion: v1
  kind: Secret
  metadata:
    name: external-ca-cert
    namespace: istio-system
  data:
  root-cert.pem: &lt;tls.cert from the step above&gt;
  EOF
$ kubectl apply -f external-ca-secret.yaml
</code></pre><p>This step is necessary for Istio to verify that the workload certificates have been signed by the correct ce