"port_value": 17011
          }
        },
        "filter_chains": [
          {
            "tls_context": {
              "common_tls_context": {
                "tls_certificates": [
                  {
                    "certificate_chain": {

		ConfigType: &envoy_core.TransportSocket_TypedConfig{
			TypedConfig: protoconv.MessageToAny(&envoy_tls.DownstreamTlsContext{
				CommonTlsContext: &envoy_tls.CommonTlsContext{
					TlsCertificates: []*envoy_tls.TlsCertificate{
						{
							CertificateChain: &envoy_core.DataSource{
								Specifier: &envoy_core.DataSource_Filename{
									Filename: "/etc/envoy/external-forward-proxy-cert.pem",
								},
							},

				PrivateKey: &core.DataSource{
					Specifier: &core.DataSource_InlineBytes{
						InlineBytes: s.PrivateKey,
					},
				},
			})
			secret.Type = &tls.Secret_TlsCertificate{
				TlsCertificate: &tls.TlsCertificate{
					CertificateChain: &core.DataSource{
						Specifier: &core.DataSource_InlineBytes{
							InlineBytes: s.CertificateChain,
						},
					},
					PrivateKeyProvider: &tls.PrivateKeyProvider{

          "last_updated": "2023-05-15T01:32:52.262Z",
          "secret": {
            "@type": "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret",
            "name": "default",
            "tls_certificate": {
              "certificate_chain": {

				},
			},
		}
		if certInfo.Staple != nil {
			tlsCertificate.OcspStaple = &core.DataSource{
				Specifier: &core.DataSource_InlineBytes{
					InlineBytes: certInfo.Staple,
				},
			}
		}
		res = protoconv.MessageToAny(&envoytls.Secret{
			Name: name,
			Type: &envoytls.Secret_TlsCertificate{
				TlsCertificate: tlsCertificate,
			},
		})
	}
	return &discovery.Resource{

  ```bash
  $ export SLEEP_POD=$(kubectl get pod -l app=sleep -o jsonpath="{.items[0].metadata.name}")
  $ istioctl pc secret $SLEEP_POD -o json | jq -r \
  '.dynamicActiveSecrets[0].secret.tlsCertificate.certificateChain.inlineBytes' | base64 --decode > chain.pem
  ```

1. Inspect the certificate content and verify that SPIRE was the issuer:

  ```bash
  $ openssl x509 -in chain.pem -text | grep SPIRE

			t.Fatal("expected tls certificates")
		}
		if commonTLSContext.TlsCertificateSdsSecretConfigs[0].Name != "default" {
			t.Fatalf("expected certificate default, actual %s",
				commonTLSContext.TlsCertificates[0].CertificateChain.String())
		}
	}
	instances := make([]*model.ServiceInstance, 0, len(services))
	for _, s := range services {
		instances = append(instances, &model.ServiceInstance{
			Service: s,

          "last_updated": "2023-05-15T01:32:52.262Z",
          "secret": {
            "@type": "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret",
            "name": "default",
            "tls_certificate": {
              "certificate_chain": {

		}
		if commonTLSContext.TlsCertificateSdsSecretConfigs[0].Name != "file-cert:httpbin.pem~httpbinkey.pem" {
			return fmt.Errorf("expected certificate httpbin.pem, actual %s", commonTLSContext.TlsCertificates[0].CertificateChain.String())
		}
		if tlsContext.RequireClientCertificate.Value {
			return fmt.Errorf("expected RequireClientCertificate to be false")
		}
		return nil
	}