uire maintaining a private signing key, which enhances security.</p></li><li><p>Simplified root certificate distribution to TLS clients. Clients no longer need to wait for Istiod to generate and distribute its CA certificate.</p></li></ul><h2 id=before-you-begin>Before you begin</h2><ul><li>Install Istio through <code>istioctl</code> with DNS certificates configured.
The configuration is read when Istiod starts.</li></ul><pre><code class=language-bash data-expandlinks=true data-repo=istio>$ cat &lt;&lt;EOF 