returnErr = fmt.Errorf("can not retrieve inlineBytes from trustCA section")
			}
		} else {
			returnStr = ""
			returnErr = fmt.Errorf("can not retrieve trustedCa from secret ROOTCA")
		}
	} else {
		returnStr = ""
		returnErr = fmt.Errorf("can not find ROOTCA from secret config dump")
	}
	return returnStr, returnErr

default           Cert Chain     ACTIVE     false          cd4902e499169b11ec171dad1668adbb             2024-10-27T22:44:37Z     2024-10-27T21:44:27Z     east.local
ROOTCA            CA             ACTIVE     true           529cbbaf623611d057b517d4ffe341e4e8035037     2034-10-23T13:23:05Z     2024-10-25T13:23:05Z     east.local

	}
	for _, secret := range secretDump.DynamicActiveSecrets {
		// check the ROOTCA from secret dump
		if secret.Name == "ROOTCA" {
			var returnStr string
			var returnErr error
			strCA, err := c.configDump.GetRootCAFromSecretConfigDump(secret.GetSecret())
			if err != nil {
				returnStr = ""
				returnErr = fmt.Errorf("can not dump ROOTCA from secret: %v", err)
			} else {
				returnStr = strCA
				returnErr = nil

  fun pinRootNotPresentInChain() {
    // Fails on 11.0.1 https://github.com/square/okhttp/issues/4703
    val rootCa =
      HeldCertificate.Builder()
        .serialNumber(1L)
        .certificateAuthority(1)
        .commonName("root")
        .build()
    val intermediateCa =
      HeldCertificate.Builder()
        .signedBy(rootCa)
        .certificateAuthority(0)
        .serialNumber(2L)
        .commonName("intermediate_ca")

              }
            }
          }
        },
        {
          "name": "ROOTCA",
          "last_updated": "2023-05-06T05:41:32.118Z",
          "secret": {
            "@type": "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret",
            "name": "ROOTCA",
            "validation_context": {
              "trusted_ca": {

              }
            }
          }
        },
        {
          "name": "ROOTCA",
          "last_updated": "2024-10-25T13:26:36.586Z",
          "secret": {
            "@type": "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret",
            "name": "ROOTCA",
            "validation_context": {
              "trusted_ca": {
              },

default           Cert Chain     ACTIVE     false          6fbee254c22900615cb1f74e3d2f1713     2023-05-16T01:32:52Z     2023-05-15T01:30:52Z

  private lateinit var rootCa: HeldCertificate
  private lateinit var certificate: HeldCertificate
  private val dns = FakeDns()
  private lateinit var url: HttpUrl
  private lateinit var serverIps: List<InetAddress>

  @BeforeEach
  fun setUp(server: MockWebServer) {
    this.server = server
    platform.assumeHttp2Support()
    platform.assumeNotBouncyCastle()
    rootCa =
      HeldCertificate.Builder()

secret/default     Cert Chain     ACTIVE     false          6fbee254c22900615cb1f74e3d2f1713     2023-05-16T01:32:52Z     2023-05-15T01:30:52Z
secret/ROOTCA      CA             ACTIVE     true           193a543fe2b0d9cd4847675394dfc54      2033-05-02T03:41:33Z     2023-05-05T03:41:33Z

NAME                                                       STATUS      LOCALITY     CLUSTER

	rootCACompareConfigCmd := &cobra.Command{
		Use:   "rootca-compare [pod/]<name-1>[.<namespace-1>] [pod/]<name-2>[.<namespace-2>]",
		Short: "Compare ROOTCA values for the two given pods",
		Long:  `Compare ROOTCA values for given 2 pods to check the connectivity between them.`,
		Example: `  # Compare ROOTCA values for given 2 pods to check the connectivity between them.
  istioctl proxy-config rootca-compare <pod-name-1[.namespace]> <pod-name-2[.namespace]>`,