func (s *Server) initDNSCertsIstiod() error {
	var certChain, keyPEM, caBundle []byte
	var err error
	// Generate certificates for Istiod DNS names, signed by Istiod CA
	certChain, keyPEM, err = s.CA.GenKeyCert(s.dnsNames, SelfSignedCACertTTL.Get(), false)
	if err != nil {
		return fmt.Errorf("failed generating istiod key cert %v", err)
	}
	log.Infof("Generating istiod-signed cert for %v:\n %s", s.dnsNames, certChain)