if found {
			if alpnOverride.GetStringValue() != "false" {
				t.Errorf("alpn_override:%s tlsMode:%s, should be false for either TLS mode SIMPLE or MUTUAL", alpnOverride, tlsMode)
			}
		} else {
			t.Errorf("alpn_override metadata should be written for either TLS mode SIMPLE or MUTUAL")
		}
	} else if ok {
		alpnOverride, found := istio.Fields[util.AlpnOverrideMetadataKey]
		if found {

		if tls.ServerCertificate == "" {
			v = AppendValidation(v, fmt.Errorf("MUTUAL TLS requires a server certificate"))
		}
		if tls.PrivateKey == "" {
			v = AppendValidation(v, fmt.Errorf("MUTUAL TLS requires a private key"))
		}
		if tls.CaCertificates == "" {
			v = AppendValidation(v, fmt.Errorf("MUTUAL TLS requires a client CA bundle"))
		}
	}
	if tls.CaCrl != "" {
		if tls.CredentialName != "" {

		// Mark the goroutine which called stopTheWorld preemptible so its
		// stack may be scanned.
		// This lets a mark worker scan us while we try to stop the world
		// since otherwise we could get in a mutual preemption deadlock.
		// We must not modify anything on the G stack because a stack shrink
		// may occur. A stack shrink is otherwise OK though because in order