// 1. fetch `istio-ca-secret` in priority
		err := loadSelfSignedCaSecret(client, namespace, caCertName, rootCertFile, caOpts)
		if err == nil {
			return nil
		} else if apierror.IsNotFound(err) {
			// 2. if `istio-ca-secret` not exist and use cacerts enabled, fallback to fetch `cacerts`
			if useCacertsSecretName {
				caCertName = CACertsSecret
				err := loadSelfSignedCaSecret(client, namespace, caCertName, rootCertFile, caOpts)