DNS.3 = istio-pilot.{{ .SystemNamespace }}
DNS.4 = istio-pilot.{{ .SystemNamespace }}.svc
[ req_dn ]
O = Istio
CN = Intermediate CA
`
)

// NewIstioConfig creates an extensions configuration for Istio, using the given system namespace in
// the DNS SANs.
func NewIstioConfig(systemNamespace string) (string, error) {
	return tmpl.Evaluate(istioConfTemplate, map[string]any{
		"SystemNamespace": systemNamespace,
	})
}

		}
	}
	caLoader, err := ca.NewRoot(strRoot)
	if err != nil {
		return nil, fmt.Errorf("error reading CA cert file %s: %v", strRoot, err)
	}
	// Create the new extensions config for the CA
	caConfig, err := ca.NewIstioConfig("istio-system")
	if err != nil {
		return nil, err
	}
	intermediateCA, err := ca.NewIntermediate(strRoot, caConfig, caLoader)
	if err != nil {
		return nil, err
	}
	ret := &caProvider{

		clusterDir := filepath.Join(certsDir, c.Name())
		if err := os.Mkdir(clusterDir, 0o700); err != nil {
			return err
		}

		// Create the new extensions config for the CA
		caConfig, err := ca.NewIstioConfig(i.cfg.SystemNamespace)
		if err != nil {
			return err
		}

		// Create the certs for the cluster.
		clusterCA, err := ca.NewIntermediate(clusterDir, caConfig, root)
		if err != nil {