ated</code></pre></li><li><p>For mutual TLS, a separate Secret named <code>&lt;tls-cert-secret>-cacert</code> with a <code>cacert</code> key is needed for the ingress gateway.</p><pre><code class=language-bash data-expandlinks=true data-repo=istio>$ kubectl create -n istio-system secret generic $INGRESS_GATEWAY_SECRET-cacert --from-file=ca.crt=trusted.crt
secret/cluster_name-hash-XXXX-cacert created</code></pre></li></ol><h2 id=configure-a-mutual-tls-ingress-gateway>Configure a mutual TLS ingress gateway</h