func (s *Server) initDNSCertsIstiod() error {
	var certChain, keyPEM, caBundle []byte
	var err error
	// Generate certificates for Istiod DNS names, signed by Istiod CA
	certChain, keyPEM, err = s.CA.GenKeyCert(s.dnsNames, SelfSignedCACertTTL.Get(), false)
	if err != nil {
		return fmt.Errorf("failed generating istiod key cert %v", err)
	}
	log.Infof("Generating istiod-signed cert for %v:\n %s", s.dnsNames, certChain)

// GetCAKeyCertBundle returns the KeyCertBundle for the CA.
func (ca *IstioCA) GetCAKeyCertBundle() *util.KeyCertBundle {
	return ca.keyCertBundle
}

// GenKeyCert generates a certificate signed by the CA,
// returns the certificate chain and the private key.
func (ca *IstioCA) GenKeyCert(hostnames []string, certTTL time.Duration, checkLifetime bool) ([]byte, []byte, error) {
	opts := util.CertOptions{
		RSAKeySize: rsaKeySize,
	}

		if err != nil {
			t.Fatalf("%s: got error while creating plugged-cert CA: %v", id, err)
		}
		if ca == nil {
			t.Fatalf("failed to create a plugged-cert CA.")
		}

		certPEM, privPEM, err := ca.GenKeyCert([]string{"host1", "host2"}, tc.certLifetime, tc.checkCertLifetime)
		if err != nil {
			if tc.expectedError == "" {
				t.Fatalf("[%s] Unexpected error: %v", id, err)
			}
			if err.Error() != tc.expectedError {