Also, note that the certificate has to contain the `Extended Key Usage: TLS Web Client Authentication`. Otherwise, MinIO would not accept the certificate as client certificate.

Now, the STS certificate-based authentication happens in 4 steps:

- Client sends HTTP `POST` request over a TLS connection hitting the MinIO TLS STS API.
- MinIO verifies that the client certificate is valid.

kind: PeerAuthentication
metadata:
  name: "default"
  annotations:
    test-suite: "automtls-partial-sidecar-dr-no-tls"
spec:
  mtls:
    mode: STRICT
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: "multiversion-route"
  annotations:
    test-suite: "automtls-partial-sidecar-dr-no-tls"
spec:
  hosts:
  - "multiversion"
  http:
  - name: "vistio-route"
    match:
    - uri:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: tls
  namespace: bar
spec:
  rules:
  - host: foo.org
    http:
      paths:
      - backend:
          service:
            name: httpbin
            port:
              number: 80
        path: /*
  tls:
  - hosts:
      - foo.org

//go:build boringcrypto

// Package fipstls allows control over whether crypto/tls requires FIPS-approved settings.
// This package only exists with GOEXPERIMENT=boringcrypto, but the effects are independent
// of the use of BoringCrypto.
package fipstls

import (
	"internal/stringslite"
	"sync/atomic"
)

var required atomic.Bool

// Force forces crypto/tls to restrict TLS configurations to FIPS-approved settings.

	public final fun signedBy (Lokhttp3/tls/HeldCertificate;)Lokhttp3/tls/HeldCertificate$Builder;
	public final fun validityInterval (JJ)Lokhttp3/tls/HeldCertificate$Builder;
}

public final class okhttp3/tls/HeldCertificate$Builder$Companion {
}

public final class okhttp3/tls/HeldCertificate$Companion {
	public final fun decode (Ljava/lang/String;)Lokhttp3/tls/HeldCertificate;

	// Is there a virtual service with a TLS block that matches us?
	hasTLSMatch := false

	lb := &ListenerBuilder{node: node, push: push}
	out := make([]*filterChainOpts, 0)
	for _, cfg := range configs {
		virtualService := cfg.Spec.(*v1alpha3.VirtualService)
		for _, tls := range virtualService.Tls {
			for _, match := range tls.Match {

# No DR is added for this test. enableAutoMtls is expected on by default.
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: "default"
  annotations:
    test-suite: "beta-mtls-automtls"
spec:
  mtls:

apiVersion: release-notes/v2
kind: bug-fix
area: networking
issue:
- 23494
releaseNotes:
- |

apiVersion: release-notes/v2
kind: bug-fix
area: networking
issue:
- 24319
releaseNotes:
- |

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  creationTimestamp: null
  name: tls-istio-autogenerated-k8s-ingress-bar
  namespace: istio-system
spec:
  selector:
    istio: ingressgateway
  servers:
  - hosts:
    - foo.org
    port:
      name: https-443-ingress-tls-bar-0
      number: 443
      protocol: HTTPS
    tls:
      credentialName: myingress-cert
      mode: SIMPLE
  - hosts:
    - '*'