val trustedCert = trustRootIndex.findByIssuerAndSignature(toVerify)
      if (trustedCert != null) {
        if (result.size > 1 || toVerify != trustedCert) {
          result.add(trustedCert)
        }
        if (verifySignature(trustedCert, trustedCert, result.size - 2)) {
          return result // The self-signed cert is a root CA. We're done.
        }

digraph { envoy -> sds [dir=both, label="SDS"] envoy -> xdsproxy [dir=both, label="ADS"] sds -> ca [label="CSR"] xdsproxy -> discovery [dir=both,label="ADS"] envoy [shape=hexagon, color=purple] subgraph cluster_istioagent { label = "Istio Agent" color="orange" sds xdsproxy } subgraph cluster_istiod { label = "Istiod" color="lightblue" ca discovery } }...

import org.codelibs.fess.es.config.bsentity.dbmeta.ElevateWordDbm;
import org.codelibs.fess.es.config.cbean.ElevateWordCB;
import org.codelibs.fess.es.config.cbean.ca.ElevateWordCA;
import org.codelibs.fess.es.config.cbean.ca.bs.BsElevateWordCA;
import org.codelibs.fess.es.config.cbean.cq.ElevateWordCQ;
import org.codelibs.fess.es.config.cbean.cq.bs.BsElevateWordCQ;
import org.dbflute.cbean.ConditionQuery;

import org.codelibs.fess.es.config.bsentity.dbmeta.FileAuthenticationDbm;
import org.codelibs.fess.es.config.cbean.FileAuthenticationCB;
import org.codelibs.fess.es.config.cbean.ca.FileAuthenticationCA;
import org.codelibs.fess.es.config.cbean.ca.bs.BsFileAuthenticationCA;
import org.codelibs.fess.es.config.cbean.cq.FileAuthenticationCQ;
import org.codelibs.fess.es.config.cbean.cq.bs.BsFileAuthenticationCQ;

import org.codelibs.fess.es.config.bsentity.dbmeta.AccessTokenDbm;
import org.codelibs.fess.es.config.cbean.AccessTokenCB;
import org.codelibs.fess.es.config.cbean.ca.AccessTokenCA;
import org.codelibs.fess.es.config.cbean.ca.bs.BsAccessTokenCA;
import org.codelibs.fess.es.config.cbean.cq.AccessTokenCQ;
import org.codelibs.fess.es.config.cbean.cq.bs.BsAccessTokenCQ;
import org.dbflute.cbean.ConditionQuery;

import org.codelibs.fess.es.config.bsentity.dbmeta.LabelTypeDbm;
import org.codelibs.fess.es.config.cbean.LabelTypeCB;
import org.codelibs.fess.es.config.cbean.ca.LabelTypeCA;
import org.codelibs.fess.es.config.cbean.ca.bs.BsLabelTypeCA;
import org.codelibs.fess.es.config.cbean.cq.LabelTypeCQ;
import org.codelibs.fess.es.config.cbean.cq.bs.BsLabelTypeCQ;
import org.dbflute.cbean.ConditionQuery;

 * certificate is signed by the certificate that follows, and the last certificate is a trusted CA
 * certificate.
 *
 * Use of the chain cleaner is necessary to omit unexpected certificates that aren't relevant to
 * the TLS handshake and to extract the trusted CA certificate for the benefit of certificate
 * pinning.
 */
abstract class CertificateChainCleaner {

         * @param op The option of condition to be set up. (NotNull)
         */
        void callback(OP op);
    }

    @FunctionalInterface
    public interface OperatorCall<CA extends EsAbstractConditionAggregation> {

        void callback(CA query);
    }

  {{- if eq .Values.global.pilotCertProvider "istiod" }}
  - name: istiod-ca-cert
    configMap:
      name: istio-ca-root-cert
  {{- end }}
  {{- if eq .Values.global.pilotCertProvider "kubernetes" }}
  - name: kube-ca-cert
    configMap:
      name: kube-root-ca.crt
  {{- end }}
  {{- if .Values.global.mountMtlsCerts }}

  {{- if eq .Values.global.pilotCertProvider "istiod" }}
  - name: istiod-ca-cert
    configMap:
      name: istio-ca-root-cert
  {{- end }}
  {{- if eq .Values.global.pilotCertProvider "kubernetes" }}
  - name: kube-ca-cert
    configMap:
      name: kube-root-ca.crt
  {{- end }}
  {{- if .Values.global.mountMtlsCerts }}