 certificates installed are correct</h3><p>When the workloads are deployed, above, they send CSR Requests to Istiod which forwards them to the Kubernetes CA for signing.
If all goes well, the signed certificates are sent back to the workloads where they are then installed.
To verify that they have been signed by the Kubernetes CA, you need to first extract the signed certificates.</p><ol><li><p>Dump all pods running in the namespace.</p><pre><code class=language-bash data-expandlinks=true data-repo=istio>$ 