type: date
    name: v1
    schema:
      openAPIV3Schema:
        properties:
          spec:
            description: 'Peer authentication configuration for workloads. See more
              details at: https://istio.io/docs/reference/config/security/peer_authentication.html'
            properties:
              mtls:
                description: Mutual TLS settings for workload.

      type: date
    name: v1
    schema:
      openAPIV3Schema:
        properties:
          spec:
            description: 'Peer authentication configuration for workloads. See more
              details at: https://istio.io/docs/reference/config/security/peer_authentication.html'
            properties:
              mtls:
                description: Mutual TLS settings for workload.

As part of this, we need to pick the correct certificate to serve on behalf of the destination workload.
As discussed in [HBONE](#hbone), this is based on the destination IP.
Additionally, we enforce the peer has a valid mesh identity (but do not assert _which_ identity, yet).

Next, we terminate the CONNECT.
From the [headers](#headers), we know the target destination.