code>subjectAltNames</code> field containing <code>nested.subdomain.example.com</code> incorrectly accepts a certificate from an upstream peer with a Subject Alternative Name (SAN) of <code>*.example.com</code>. Instead a SAN of <code>*.subdomain.example.com</code> or <code>nested.subdomain.example.com</code> should be present.</p></li><li><p>Use of Istio&rsquo;s <a href=/v1.17/docs/reference/config/networking/service-entry/><code>subjectAltNames</code> in service entries</a>. A service entry with a <code>s