pt mutual TLS traffic.</p><pre><code class=language-bash data-expandlinks=true data-repo=istio>$ kubectl apply -n foo -f - &lt;&lt;EOF
apiVersion: &#34;security.istio.io/v1beta1&#34;
kind: &#34;PeerAuthentication&#34;
metadata:
  name: &#34;default&#34;
spec:
  mtls:
    mode: STRICT
EOF
</code></pre></li></ol><h2 id=verifying-the-certificates>Verifying the certificates</h2><p>In this section, we verify that workload certificates are signed by the certificates that we plugged into the CA.
This requires you 