i><p>The certificate used by the Kubernetes CA (specifically the <code>kubernetes.io/legacy-unknown</code> signer) is loaded onto the secret associated with every service account in the bookinfo namespace.</p><pre><code class=language-bash data-expandlinks=true data-repo=istio>$ kubectl get secrets -n bookinfo
</code></pre><p>Pick a secret-name that is associated with any of the service-accounts. These have a &ldquo;token&rdquo; in their name.</p><pre><code class=language-bash data-expandlinks=true data-rep