Name:      sa,
			})
		}
		return res
	}()

	CertSignerDomain = env.Register("CERT_SIGNER_DOMAIN", "", "The cert signer domain info").Get()

	UseCacertsForSelfSignedCA = env.Register("USE_CACERTS_FOR_SELF_SIGNED_CA", false,
		"If enabled, istiod will use a secret named cacerts to store its self-signed istio-"+
			"generated root certificate.").Get()

			istioGenerated = true
		}
	}

	// check if signing key file exists the cert dir and if the istio-generated file
	// exists (only if USE_CACERTS_FOR_SELF_SIGNED_CA is enabled)
	if !detectedSigningCABundle {
		log.Infof("Use roots from istio-ca-secret")

		caBundle = s.CA.GetCAKeyCertBundle().GetRootCertPem()

		if features.UseCacertsForSelfSignedCA && istioGenerated {
			log.Infof("IstioGenerated %s secret found, use it as the CA certificate", ca.CACertsSecret)

			// TODO(jaellio): Currently, when the USE_CACERTS_FOR_SELF_SIGNED_CA flag is true istiod
			// handles loading and updating the "cacerts" secret with the "istio-generated" key the
			// same way it handles the "istio-ca-secret" secret. Isitod utilizes a secret watch instead