=/v1.20/docs/tasks/security/authentication/mtls-migration/><code>PERMISSIVE</code> mode</a> for the workload, so it can accept both plaintext and mutual TLS traffic. Please keep in mind that mutual TLS is not enforced with this option.</p></li></ol></div><h5 id=cert-lifetime-config class=question>How to configure the lifetime for Istio certificates?</h5><div class=answer><p>For the workloads running in Kubernetes, the lifetime of their Istio certificates is by default 24 hours.</p><p>This configuration may 