func TestIsEqSpliceStr(t *testing.T) {
	testCases := []struct {
		certs1  []string
		certs2  []string
		expSame bool
	}{
		{
			certs1:  []string{"a", "b"},
			certs2:  []string{},
			expSame: false,
		},
		{
			certs1:  []string{"a", "b"},
			certs2:  []string{"b"},
			expSame: false,
		},
		{
			certs1:  []string{"a", "b"},
			certs2:  []string{"a", "b"},
			expSame: true,
		},
	}

	p, _ := pem.Decode([]byte(rsaCertPEM))
	if p == nil {
		t.Fatal("Failed to decode certificate")
	}

	certA, err := cc.newCert(p.Bytes)
	if err != nil {
		t.Fatalf("newCert failed: %s", err)
	}
	certB, err := cc.newCert(p.Bytes)
	if err != nil {
		t.Fatalf("newCert failed: %s", err)
	}
	if certA.cert != certB.cert {
		t.Fatal("newCert returned a unique reference for a duplicate certificate")
	}

spec:
  servers:
  - hosts:
    - cert/cert1.domain.example
    port:
      name: default
      number: 443
      protocol: HTTPS
    tls:
      credentialName: kubernetes-gateway://cert/cert
      mode: SIMPLE
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  annotations:
    internal.istio.io/parents: HTTPRoute/http.cert
    internal.istio.io/route-semantics: gateway

	"net/http"
	"reflect"
	"testing"

	"github.com/minio/pkg/v3/certs"
)

func TestNewServer(t *testing.T) {
	nonLoopBackIP := getNonLoopBackIP(t)
	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		fmt.Fprintf(w, "Hello, world")
	})

	testCases := []struct {
		addrs   []string
		handler http.Handler
		certFn  certs.GetCertificateFunc
	}{
		{[]string{"127.0.0.1:9000"}, handler, nil},

          name: workload-certs
        - mountPath: /var/run/secrets/istio
          name: istiod-ca-cert
        - mountPath: /var/lib/istio/data
          name: istio-data
        - mountPath: /etc/istio/proxy
          name: istio-envoy
        - mountPath: /var/run/secrets/tokens
          name: istio-token
        - mountPath: /etc/certs/
          name: istio-certs
          readOnly: true

	cert := certs[0]

	// gets the node name from the certificate common name
	return strings.TrimPrefix(cert.Subject.CommonName, constants.NodesUserPrefix), nil
}

func getAPIEndpoint(client clientset.Interface, nodeName string, apiEndpoint *kubeadmapi.APIEndpoint) error {
	return getAPIEndpointWithRetry(client, nodeName, apiEndpoint,

//  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
//  See the License for the specific language governing permissions and
//  limitations under the License.

package cert

import (
	"fmt"
	"os/exec"
)

// GenerateKey and writes output to keyFile.
func GenerateKey(keyFile string) error {
	return openssl("genrsa", "-out", keyFile, "1024")
}

				PrivateKey:  file.AsStringOrFail(t, path.Join(env.IstioSrc, "tests/testdata/certs/dns/key.pem")),
				CaCert:      file.AsStringOrFail(t, path.Join(env.IstioSrc, "tests/testdata/certs/dns/root-cert.pem")),
				Crl:         file.AsStringOrFail(t, path.Join(env.IstioSrc, "tests/testdata/certs/ca.crl")),
			}, false)

			// Configured with dummy CRL

		},
	}

	if callType == Mtls {
		opts.TLS.Key = tlsCtx.PrivateKey
		opts.TLS.Cert = tlsCtx.Cert
	}

	// Certs occasionally take quite a while to become active in Envoy, so retry for a long time (2min)
	ing.CallOrFail(ctx, opts)
}

// RotateSecrets deletes kubernetes secrets by name in credNames and creates same secrets using key/cert
// from ingressCred.

	certBytes := []byte(certECDSA)
	certBytes = AppendCertByte(certBytes, []byte(certRSA))
	result := PemCertBytestoString(certBytes)
	cert1 := strings.TrimSuffix(strings.TrimPrefix(certECDSA, "\n"), "\n")
	cert2 := strings.TrimSuffix(strings.TrimPrefix(certRSA, "\n"), "\n")
	if !reflect.DeepEqual(result, []string{cert1, cert2}) {
		t.Errorf("Basic comparison fails!")
	}

	// check only first string passed if second is bogus