}

	if isSimpleOrMutual(serverTLSSettings.Mode) {
		// If Mesh TLSDefaults are set, use them.
		applyDownstreamTLSDefaults(mesh.GetTlsDefaults(), ctx.CommonTlsContext)
		applyServerTLSSettings(serverTLSSettings, ctx.CommonTlsContext)
	}

	// Compliance for Envoy TLS downstreams.
	authnmodel.EnforceCompliance(ctx.CommonTlsContext)
	return ctx
}