newCerts[0] = cert;
            certChains.put(alias, newCerts);
        } else {
            Certificate[] updatedCerts = Arrays.copyOf(certs, certs.length + 1);
            updatedCerts[certs.length] = cert;
            certChains.put(alias, updatedCerts);
        }
    }

    @Override
    public void engineDeleteEntry(String alias) throws KeyStoreException {
        keys.remove(alias);

	retry.UntilOrFail(t, func() bool {
		updatedCert, _, err := getWorkloadSecret(t, []v1.Pod{ztunnelPod}, serviceAccount, istioCtl)
		if err != nil {
			t.Logf("failed to get current workload secret: %v", err)
			return false
		}

		// retry when workload cert is not updated
		if originalCert.CertChain[0].ValidFrom != updatedCert.CertChain[0].ValidFrom {
			newSecret = updatedCert
			t.Logf("workload cert is updated")