kubectl get pods -n bookinfo
</code></pre><p>Pick any one of the running pods for the next step.</p></li><li><p>Get the certificate chain and CA root certificate used by the Istio proxies for mTLS.</p><pre><code class=language-bash data-expandlinks=true data-repo=istio>$ istioctl pc secret &lt;pod-name&gt; -o json &gt; proxy_secret
</code></pre><p>The proxy_secret json file contains the CA root certificate for mTLS in the <code>trustedCA</code> field. Note that this certificate is base64 encoded.</p></li><l