CaCert:      file.AsStringOrFail(t, path.Join(env.IstioSrc, "tests/testdata/certs/dns/root-cert.pem")),
				Crl:         file.AsStringOrFail(t, path.Join(env.IstioSrc, "tests/testdata/certs/ca.crl")),
			}, false)

			// Configured with dummy CRL
			ingressutil.CreateIngressKubeSecret(t, credWithDummyCRL, ingressutil.Mtls, ingressutil.IngressCredential{

		"kubernetes://generic", "kubernetes://generic-mtls", "kubernetes://generic-mtls-cacert",
		"kubernetes://generic-mtls-split", "kubernetes://generic-mtls-split-cacert", "kubernetes://generic-mtls-crl",
		"kubernetes://generic-mtls-crl-cacert",
	}
	cases := []struct {
		name                 string
		proxy                *model.Proxy
		resources            []string
		request              *model.PushRequest

{
    "signing": {
        "default": {
            "usages": [
                "digital signature",
                "cert sign",
                "crl sign",
                "signing",
                "key encipherment",
                "client auth"
            ],
            "expiry": "876000h",
            "ca_constraint": {
                "is_ca": true
            }
        }
    }

							ResourceApiVersion: core.ApiVersion_V3,
						},
					},
				},
			},
		},
		{
			name: "MTLSStrict using SDS with CRL",
			node: &model.Proxy{
				Metadata: &model.NodeMetadata{},
			},
			validateClient: true,
			crl:            "/custom/path/to/crl.pem",
			expected: &auth.CommonTlsContext{
				TlsCertificateSdsSecretConfigs: []*auth.SdsSecretConfig{
					{
						Name: "default",

kind: feature
area: security
docs:
  - https://docs.google.com/document/d/13LNbJnLHe_prlOg7sPr77PjLiIuGj452/edit?usp=sharing&ouid=105743966233121608166&rtpof=true&sd=true
releaseNotes:
  - |

		return nil, errors.New("x509: malformed tbs crl")
	}
	rl.RawTBSRevocationList = tbs
	if !tbs.ReadASN1(&tbs, cryptobyte_asn1.SEQUENCE) {
		return nil, errors.New("x509: malformed tbs crl")
	}

	var version int
	if !tbs.PeekASN1Tag(cryptobyte_asn1.INTEGER) {
		return nil, errors.New("x509: unsupported crl version")
	}
	if !tbs.ReadASN1Integer(&version) {

	if validateClient {
		defaultValidationContext := &tls.CertificateValidationContext{
			MatchSubjectAltNames: matchSAN,
		}
		if crl != "" {
			defaultValidationContext.Crl = &core.DataSource{
				Specifier: &core.DataSource_Filename{
					Filename: crl,
				},
			}
		}
		tlsContext.ValidationContextType = &tls.CommonTlsContext_CombinedValidationContext{

{
    "signing": {
        "default": {
            "usages": [
                "digital signature",
                "cert sign",
                "crl sign",
                "signing",
                "key encipherment",
                "client auth"
            ],
            "expiry": "876000h",
            "ca_constraint": {
                "is_ca": true
            }
        }
    }

{
    "signing": {
        "default": {
            "usages": [
                "digital signature",
                "cert sign",
                "crl sign",
                "signing",
                "key encipherment",
                "client auth"
            ],
            "expiry": "876000h",
            "ca_constraint": {
                "is_ca": true
            }
        }
    }

	// The ID/name for the CRL in kubernetes tls secret
	tlsScrtCaCrl = "ca.crl"
	// The ID/name for the certificate chain in kubernetes generic secret.
	genericScrtCert = "cert"
	// The ID/name for the private key in kubernetes generic secret.
	genericScrtKey = "key"
	// The ID/name for the CA certificate in kubernetes generic secret.
	genericScrtCaCert = "cacert"
	// The ID/name for the CRL in kubernetes generic secret.