as the gateway Service address in the SNI header.</p></li><li><p>Mesh listener</p><p>A dedicated listener is created in the Gateway that mutually authenticates the Istio mTLS traffic.
After the outer Istio mTLS termination, it unconditionally sends the inner TLS traffic with a TCP proxy
to the other (internal) listener in the same Gateway.</p></li><li><p>SNI forwarder</p><p>Another listener with SNI forwarder performs a new TLS header inspection for the original TLS session.
If the inner SNI hostname matche