func isCertificateRequestApproved(csr *certv1.CertificateSigningRequest) bool {
	approved, denied := getCertApprovalCondition(&csr.Status)
	return approved && !denied
}

func getCertApprovalCondition(status *certv1.CertificateSigningRequestStatus) (approved bool, denied bool) {
	for _, c := range status.Conditions {
		if c.Type == certv1.CertificateApproved {
			approved = true
		}

    val pin = Pin("example.com", certA1Sha256Pin)
    assertTrue(pin.matchesCertificate(certA1.certificate))
    assertFalse(pin.matchesCertificate(certB1.certificate))
  }

  @Test fun testMatchesSha1() {
    val pin = Pin("example.com", certC1Sha1Pin)
    assertTrue(pin.matchesCertificate(certC1.certificate))
    assertFalse(pin.matchesCertificate(certB1.certificate))
  }

  @Test fun pinList() {
    val builder =

      )
    assertThat(cleaner.clean(list(certB, certA), "hostname")).isEqualTo(
      list(certB, certA, trusted, selfSigned),
    )
    assertThat(cleaner.clean(list(certB, certA, trusted), "hostname")).isEqualTo(
      list(certB, certA, trusted, selfSigned),
    )
    assertThat(cleaner.clean(list(certB, certA, trusted, selfSigned), "hostname"))
      .isEqualTo(
        list(certB, certA, trusted, selfSigned),
      )
  }

                name: inject-volume
                mountPath: /var/lib/istio/inject
{{- end }}
`, map[string]any{
		"rootcert1":              cert1.Rootcert,
		"signer1":                cert1.Signer,
		"rootcert2":              cert2.Rootcert,
		"signer2":                cert2.Signer,
		"isConfigCluster":        isConfigCluster,
		"isExternalControlPlane": isExternalControlPlane,
	})
	return cfgYaml

openssl req -new -key int2-key.pem -out int2-cert.csr -config int2-cert.cfg -batch -sha256

openssl x509 -req -days 3650 -in int2-cert.csr -sha256 -CA int-cert.pem -CAkey int-key.pem -CAcreateserial -out int2-cert.pem -extensions v3_req -extfile int2-cert.cfg



cat root-cert.pem > int-cert-chain.pem
cat int-cert.pem >> int-cert-chain.pem
cp int-cert-chain.pem int2-cert-chain.pem
cat int2-cert.pem >> int2-cert-chain.pem

rm ./*csr

	return CreateCustomCASecret(ctx,
		"ca-cert.pem", "ca-key.pem",
		"cert-chain.pem", "root-cert.pem")
}

// CreateCASecretAlt creates a k8s secret "cacerts" to store the CA key and cert using an alternative set of certs.
func CreateCASecretAlt(ctx resource.Context) error {
	return CreateCustomCASecret(ctx,
		"ca-cert-alt.pem", "ca-key-alt.pem",
		"cert-chain-alt.pem", "root-cert-alt.pem")
}

See the License for the specific language governing permissions and
limitations under the License.
*/

package options

import "github.com/spf13/pflag"

// AddCertificateDirFlag adds the --certs-dir flag to the given flagset
func AddCertificateDirFlag(fs *pflag.FlagSet, certsDir *string) {
	fs.StringVar(certsDir, CertificatesDir, *certsDir, "The path where to save the certificates")

	p, _ := pem.Decode([]byte(rsaCertPEM))
	if p == nil {
		t.Fatal("Failed to decode certificate")
	}

	certA, err := cc.newCert(p.Bytes)
	if err != nil {
		t.Fatalf("newCert failed: %s", err)
	}
	certB, err := cc.newCert(p.Bytes)
	if err != nil {
		t.Fatalf("newCert failed: %s", err)
	}
	if certA.cert != certB.cert {
		t.Fatal("newCert returned a unique reference for a duplicate certificate")
	}

spec:
  servers:
  - hosts:
    - cert/cert1.domain.example
    port:
      name: default
      number: 443
      protocol: HTTPS
    tls:
      credentialName: kubernetes-gateway://cert/cert
      mode: SIMPLE
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  annotations:
    internal.istio.io/parents: HTTPRoute/http.cert
    internal.istio.io/route-semantics: gateway

	"net/http"
	"reflect"
	"testing"

	"github.com/minio/pkg/v3/certs"
)

func TestNewServer(t *testing.T) {
	nonLoopBackIP := getNonLoopBackIP(t)
	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		fmt.Fprintf(w, "Hello, world")
	})

	testCases := []struct {
		addrs   []string
		handler http.Handler
		certFn  certs.GetCertificateFunc
	}{
		{[]string{"127.0.0.1:9000"}, handler, nil},