"ccupssm;":                         '\U00002A50',
		"cdot;":                            '\U0000010B',
		"cedil;":                           '\U000000B8',
		"cemptyv;":                         '\U000029B2',
		"cent;":                            '\U000000A2',
		"centerdot;":                       '\U000000B7',
		"cfr;":                             '\U0001D520',
		"chcy;":                            '\U00000447',

	"⩐":                         "\u2a50",
	"ċ":                            "\u010b",
	"¸":                           "\u00b8",
	"⦲":                         "\u29b2",
	"¢":                            "\u00a2",
	"·":                       "\u00b7",
	"𝔠":                             "\U0001d520",
	"ч":                            "\u0447",

		if len(cert.PermittedDNSDomains) != 2 || cert.PermittedDNSDomains[0] != ".example.com" || cert.PermittedDNSDomains[1] != "example.com" {
			t.Errorf("%s: failed to parse name constraints: %#v", test.name, cert.PermittedDNSDomains)
		}

		if len(cert.ExcludedDNSDomains) != 1 || cert.ExcludedDNSDomains[0] != "bar.example.com" {
			t.Errorf("%s: failed to parse name constraint exclusions: %#v", test.name, cert.ExcludedDNSDomains)
		}

				},
				RequireClientCertificate: proto.BoolFalse,
			},
		},
		{
			// Credential name and subject names are specified, SDS configs are generated for fetching
			// key/cert and root cert.
			name: "credential name subject alternative name key and cert tls MUTUAL",
			server: &networking.Server{
				Hosts: []string{"httpbin.example.com", "bookinfo.example.com"},
				Port: &networking.Port{
					Protocol: string(protocol.HTTPS),

          {{- end }}
          {{- if eq .Values.global.pilotCertProvider "istiod" }}
          - name: istiod-ca-cert
            configMap:
              name: istio-ca-root-cert
          {{- end }}
          {{- if eq .Values.global.pilotCertProvider "kubernetes" }}
          - name: kube-ca-cert
            configMap:
              name: kube-root-ca.crt
          {{- end }}

			}
			keys[e.Subject] = k
		}
		cert := genCertEdge(t, e.Subject, k, e.MutateTemplate, e.Type, issuerCert, issuerKey)
		certs[e.Subject] = cert
		if e.Subject == d.Leaf {
			leaf = cert
		} else {
			if e.Constraint != nil {
				intermediatePool.AddCertWithConstraint(cert, e.Constraint)
			} else {
				intermediatePool.AddCert(cert)
			}
		}
	}

			},
			"", "",
		},
		{
			"mutual no server cert",
			&networking.ServerTLSSettings{
				Mode:              networking.ServerTLSSettings_MUTUAL,
				ServerCertificate: "",
				PrivateKey:        "Khan Noonien Singh",
				CaCertificates:    "Commander William T. Riker",
			},
			"server certificate", "",
		},
		{
			"mutual sds no server cert",
			&networking.ServerTLSSettings{

#
#
function generate-certs {
  local -r cert_create_debug_output=$(mktemp "${KUBE_TEMP}/cert_create_debug_output.XXX")
  # Note: This was heavily cribbed from make-ca-cert.sh
  (set -x
    cd "${CERT_DIR}"
    ./easyrsa init-pki
    # this puts the cert into pki/ca.crt and the key into pki/private/ca.key
    # PRIMARY_CN (expected to be) defined by caller
    # shellcheck disable=SC2153

							UseClientProtocol: true,
						},
					},
					Tls: &networking.ClientTLSSettings{
						CaCertificates: "root-cert.pem",
						Mode:           networking.ClientTLSSettings_SIMPLE,
					},
				},
			},
			expectedCaCertificateName: "root-cert.pem",
			enableVerifyCertAtClient:  true,
		},
		{
			name:        "VerifyCertAtClient set and destination rule without CaCertificates",

    params+=("--server-ca-cert=${KONNECTIVITY_SERVER_CA_CERT_PATH}")
    params+=("--server-cert=${KONNECTIVITY_SERVER_CERT_PATH}")
    params+=("--server-key=${KONNECTIVITY_SERVER_KEY_PATH}")
    params+=("--cluster-ca-cert=${KONNECTIVITY_AGENT_CA_CERT_PATH}")
  fi
  params+=("--cluster-cert=/etc/srv/kubernetes/pki/apiserver.crt")