_, err := istioClient.Gateways(istioNamespace).Create(context.TODO(), invalidGateway, createOptions)
	rejected := err != nil
	if rejected != shouldReject {
		t.Errorf("Config rejected: %t, expected config rejected: %t", rejected, shouldReject)
	}

	s.faultInjectLock.Lock()
	s.rejectCSR = reject
	s.faultInjectLock.Unlock()
	if reject {
		caServerLog.Info("force CA server to return error to CSR")
	}
}

func (s *CAServer) shouldReject() bool {
	var reject bool
	s.faultInjectLock.Lock()
	reject = s.rejectCSR
	s.faultInjectLock.Unlock()
	return reject
}

// SendEmptyCert force CA server send empty cert chain.