public void engineSetCertificateEntry(String alias, Certificate cert) throws KeyStoreException {
        Certificate[] certs = certChains.get(alias);
        if (certs == null) {
            Certificate[] newCerts = new Certificate[1];
            newCerts[0] = cert;
            certChains.put(alias, newCerts);
        } else {
            Certificate[] updatedCerts = Arrays.copyOf(certs, certs.length + 1);
            updatedCerts[certs.length] = cert;

			}
		}
		return true
	})
}

func isValidSecret(secret *resource.Instance) bool {
	s, ok := secret.Message.(*corev1.Secret)
	if !ok {
		return false
	}
	certs, err := kube.ExtractCertInfo(s)
	if err != nil {
		return false
	}
	if err = xds.ValidateCertificate(certs.Cert); err != nil {
		return false
	}
	return true
}

Usage examples:

```shell
go install ./pkg/test/echo/cmd/client
# Send request to 127.0.0.1:8080 (Note only IPs are supported) via an HBONE proxy on port 15008
client --hbone-client-cert tests/testdata/certs/cert.crt --hbone-client-key tests/testdata/certs/cert.key \
  http://127.0.0.1:8080 \
  --hbone 127.0.0.1:15008
```

#### Golang

An (unstable) library to make HBONE connections is available at `pkg/hbone`.

Usage example:

	return configMapNamespace + "/" + configMapName
}

func encodeCertificates(certs ...*x509.Certificate) ([]byte, error) {
	b := bytes.Buffer{}
	for _, cert := range certs {
		if err := pem.Encode(&b, &pem.Block{Type: "CERTIFICATE", Bytes: cert.Raw}); err != nil {
			return []byte{}, err
		}
	}
	return b.Bytes(), nil

      protocol: HTTPS
    hosts:
    - uk.bookinfo.com
    tls:
      # We can reuse the standard Istio certs mounted in the gateway
      mode: SIMPLE #enables HTTPS on this port
      serverCertificate: /etc/certs/cert-chain.pem
      privateKey: /etc/certs/key.pem
      caCertificates: /etc/certs/root-cert.pem

	certs := []*x509.Certificate{}
	for _, pemData := range pemData {
		certs = append(certs, getCert(t, pemData))
	}
	return certs
}

func TestCertificateIdentifier(t *testing.T) {
	tt := []struct {
		name               string
		cert               *x509.Certificate
		expectedIdentifier string
	}{
		{
			name:               "client cert",

          name: istio-data
        - mountPath: /etc/istio/pod
          name: podinfo
        - mountPath: /etc/istio/ingressgateway-certs
          name: ingressgateway-certs
          readOnly: true
        - mountPath: /etc/istio/ingressgateway-ca-certs
          name: ingressgateway-ca-certs
          readOnly: true
      securityContext:
        runAsGroup: 1337
        runAsNonRoot: true
        runAsUser: 1337

          name: istio-data
        - mountPath: /etc/istio/pod
          name: podinfo
        - mountPath: /etc/istio/egressgateway-certs
          name: egressgateway-certs
          readOnly: true
        - mountPath: /etc/istio/egressgateway-ca-certs
          name: egressgateway-ca-certs
          readOnly: true
      securityContext:
        runAsGroup: 1337
        runAsNonRoot: true
        runAsUser: 1337

Justin SB <******@****.***> 1546536079 -0500

Justin SB <******@****.***> 1546536079 -0500