if !newCert.Equal(readCert) {
		t.Errorf("read cert does not match with expected new cert")
	}
}

// writeTestCertificate is a utility for creating a test certificate
func writeTestCertificate(t *testing.T, dir, name string, caCert *x509.Certificate, caKey crypto.Signer, organization []string, notBefore, notAfter time.Time) *x509.Certificate {

	return CreateCustomCASecret(ctx,
		"ca-cert.pem", "ca-key.pem",
		"cert-chain.pem", "root-cert.pem")
}

// CreateCASecretAlt creates a k8s secret "cacerts" to store the CA key and cert using an alternative set of certs.
func CreateCASecretAlt(ctx resource.Context) error {
	return CreateCustomCASecret(ctx,
		"ca-cert-alt.pem", "ca-key-alt.pem",
		"cert-chain-alt.pem", "root-cert-alt.pem")
}

	if features.SkipValidateTrustDomain {
		return nil
	}

	tds := append([]string{meshConfig.TrustDomain}, meshConfig.TrustDomainAliases...)
	for _, cacert := range meshConfig.GetCaCertificates() {
		tds = append(tds, cacert.GetTrustDomains()...)
	}
	return dedupTrustDomains(tds)
}

func dedupTrustDomains(tds []string) []string {
	known := sets.New[string]()
	deduped := make([]string, 0, len(tds))

			// Create a valid kubernetes secret to provision key/cert for sidecar.
			ingressutil.CreateIngressKubeSecretInNamespace(t, credNameGeneric, ingressutil.Mtls, ingressutil.IngressCredential{
				Certificate: file.AsStringOrFail(t, path.Join(env.IstioSrc, "tests/testdata/certs/dns/cert-chain.pem")),
				PrivateKey:  file.AsStringOrFail(t, path.Join(env.IstioSrc, "tests/testdata/certs/dns/key.pem")),

{{ template "base" .KubeHome }}
readonly ETCD_APISERVER_CA_KEY={{.CAKey}}
readonly ETCD_APISERVER_CA_CERT={{.CACert}}
readonly ETCD_APISERVER_SERVER_KEY={{.APIServerKey}}
readonly ETCD_APISERVER_SERVER_CERT={{.APIServerCert}}
readonly ETCD_APISERVER_CLIENT_KEY={{.ETCDKey}}
readonly ETCD_APISERVER_CLIENT_CERT={{.ETCDCert}}
readonly ETCD_SERVERS={{.ETCDServers}}
readonly ETCD_APISERVER_CA_CERT_PATH={{.CACertPath}}

[alt_names]
URI = $san
EOF

certchain="$FINAL_DIR"/cert-chain.pem
cacert="$FINAL_DIR"/ca-cert.pem
cakey="$FINAL_DIR"/ca-key.pem
rootcert="$FINAL_DIR"/root-cert.pem

if [[ "$rootselect" = "use-alternative-root" ]] ; then
  certchain="$FINAL_DIR"/cert-chain-alt.pem
  cacert="$FINAL_DIR"/ca-cert-alt.pem
  cakey="$FINAL_DIR"/ca-key-alt.pem
  rootcert="$FINAL_DIR"/root-cert-alt.pem
fi

	// certificate that is preceded by the CAs that sign them.
	var lastCACert *certsphase.KubeadmCert
	for _, cert := range certsphase.GetDefaultCertList() {
		var phase workflow.Phase
		if cert.CAName == "" {
			phase = newCertSubPhase(cert, runCAPhase(cert))
			lastCACert = cert
		} else {
			phase = newCertSubPhase(cert, runCertPhase(cert, lastCACert))
		}
		subPhases = append(subPhases, phase)
	}

}

// SetupPkiDirWithCertificateAuthority is a utility function for kubeadm testing that creates a
// CertificateAuthority cert/key pair into /pki subfolder of a given temporary directory.
// The function returns the path of the created pki.
func SetupPkiDirWithCertificateAuthority(t *testing.T, tmpdir string) string {
	caCert, caKey := certtestutil.SetupCertificateAuthority(t)

	certDir := filepath.Join(tmpdir, "pki")

current-context: user2@kubernetes
kind: Config
preferences: {}
users:
- name: user2
  user:
    token: cba
`
)

type configClient struct {
	clusterName string
	userName    string
	serverURL   string
	caCert      []byte
}

type configClientWithCerts struct {
	clientKey  []byte
	clientCert []byte
}

type configClientWithToken struct {
	token string
}

func TestCreateWithCerts(t *testing.T) {

	"/etc/pki/tls/certs/ca-bundle.crt",                  // Fedora/RHEL 6
	"/etc/ssl/ca-bundle.pem",                            // OpenSUSE
	"/etc/pki/tls/cacert.pem",                           // OpenELEC
	"/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem", // CentOS/RHEL 7
	"/etc/ssl/cert.pem",                                 // Alpine Linux
}

// Possible directories with certificate files; all will be read.
var certDirectories = []string{