Also, note that the certificate has to contain the `Extended Key Usage: TLS Web Client Authentication`. Otherwise, MinIO would not accept the certificate as client certificate.

Now, the STS certificate-based authentication happens in 4 steps:

- Client sends HTTP `POST` request over a TLS connection hitting the MinIO TLS STS API.
- MinIO verifies that the client certificate is valid.

	// Is there a virtual service with a TLS block that matches us?
	hasTLSMatch := false

	lb := &ListenerBuilder{node: node, push: push}
	out := make([]*filterChainOpts, 0)
	for _, cfg := range configs {
		virtualService := cfg.Spec.(*v1alpha3.VirtualService)
		for _, tls := range virtualService.Tls {
			for _, match := range tls.Match {

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: tls
  namespace: bar
spec:
  rules:
  - host: foo.org
    http:
      paths:
      - backend:
          service:
            name: httpbin
            port:
              number: 80
        path: /*
  tls:
  - hosts:
      - foo.org

//go:build boringcrypto

// Package fipstls allows control over whether crypto/tls requires FIPS-approved settings.
// This package only exists with GOEXPERIMENT=boringcrypto, but the effects are independent
// of the use of BoringCrypto.
package fipstls

import (
	"internal/stringslite"
	"sync/atomic"
)

var required atomic.Bool

// Force forces crypto/tls to restrict TLS configurations to FIPS-approved settings.

	public final fun signedBy (Lokhttp3/tls/HeldCertificate;)Lokhttp3/tls/HeldCertificate$Builder;
	public final fun validityInterval (JJ)Lokhttp3/tls/HeldCertificate$Builder;
}

public final class okhttp3/tls/HeldCertificate$Builder$Companion {
}

public final class okhttp3/tls/HeldCertificate$Companion {
	public final fun decode (Ljava/lang/String;)Lokhttp3/tls/HeldCertificate;

metadata:
  annotations:
    internal.istio.io/parents: TLSRoute/tls-match.default
    internal.istio.io/route-semantics: gateway
  creationTimestamp: null
  name: tls-match-tls-0-istio-autogenerated-k8s-gateway
  namespace: default
spec:
  gateways:
  - istio-system/gateway-istio-autogenerated-k8s-gateway-passthrough
  hosts:
  - foo.com
  tls:
  - match:
    - sniHosts:
      - foo.com
    route:

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  creationTimestamp: null
  name: tls-istio-autogenerated-k8s-ingress-bar
  namespace: istio-system
spec:
  selector:
    istio: ingressgateway
  servers:
  - hosts:
    - foo.org
    port:
      name: https-443-ingress-tls-bar-0
      number: 443
      protocol: HTTPS
    tls:
      credentialName: myingress-cert
      mode: SIMPLE
  - hosts:
    - '*'

#$ Used in:
#$ - site-src/guides/tls.md
apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: tls-basic
spec:
  gatewayClassName: acme-lb
  listeners:
  - name: foo-https
    protocol: HTTPS
    port: 443
    hostname: foo.example.com
    tls:
      certificateRefs:
      - kind: Secret
        group: ""
        name: foo-example-com-cert
  - name: bar-https
    protocol: HTTPS
    port: 443

apiVersion: release-notes/v2
kind: bug-fix
area: networking
issue:
- 29538
releaseNotes:
- |

      "https://www.googleapis.com/robots.txt",
      "https://graph.facebook.com/robots.txt",
      "https://api.twitter.com/robots.txt",
      "https://connect.squareup.com/robots.txt",
    )

  println("TLS1.3+TLS1.2")
  testClient(urls, buildClient(ConnectionSpec.RESTRICTED_TLS))

  println("\nTLS1.3 only")
  testClient(urls, buildClient(TLS_13))

  println("\nTLS1.3 then fallback")