if err != nil {
			return nil, fmt.Errorf("failed to create an istiod CA: %v", err)
		}

		s.initCACertsWatcher()
	}
	istioCA, err := ca.NewIstioCA(caOpts)
	if err != nil {
		return nil, fmt.Errorf("failed to create an istiod CA: %v", err)
	}

	// Start root cert rotator in a separate goroutine.
	istioCA.Run(s.internalStop)
	return istioCA, nil
}