} else {
			for i, ca := range secret.CertChain {
				t := "Intermediate"
				if i == 0 {
					t = "Leaf"
				} else if i == len(secret.CertChain)-1 {
					t = "Root"
				}
				n := new(big.Int)
				n, _ = n.SetString(ca.SerialNumber, 10)
				fmt.Fprintf(w, "%v\t%v\t%v\t%v\t%x\t%v\t%v\n",
					secret.Identity, t, secret.State, certNotExpired(ca), n, valueOrNA(ca.ExpirationTime), valueOrNA(ca.ValidFrom))
			}

![SDS decision flow](docs/sds-flow.svg)

### Default CA Flow through istio-agent

![CA Flow](docs/ca.svg)

A single SDS request from Envoy goes through a few different layers in istio-agent.

        if (opLambda != null) {
            opLambda.callback(builder);
        }
        if (aggsLambda != null) {
            GroupCA ca = new GroupCA();
            aggsLambda.callback(ca);
            ca.getAggregationBuilderList().forEach(builder::subAggregation);
        }
    }

        .commonName("root")
        .addSubjectAlternativeName("root_ca.com")
        .build()
    serverIntermediateCa =
      HeldCertificate.Builder()
        .signedBy(serverRootCa)
        .certificateAuthority(0)
        .serialNumber(2L)
        .commonName("intermediate_ca")
        .addSubjectAlternativeName("intermediate_ca.com")
        .build()
    serverCert =
      HeldCertificate.Builder()

          "jobs.kt.com.",
          "home.netscape.com",
          "web.stanford.edu",
          "stanford.edu",
          "state.ca.us",
          "www.state.ca.us",
          "state.ca.us",
          "pvt.k12.ca.us",
          "www.rave.ca.",
          "cnn.ca",
          "ledger-enquirer.com",
          "it-trace.ch",
          "cool.dk",
          "cool.co.uk",
          "cool.de",

      - name: istio-token
        projected:
          sources:
          - serviceAccountToken:
              audience: istio-ca
              expirationSeconds: 43200
              path: istio-token
      - configMap:
          name: istio-ca-root-cert
        name: istiod-ca-cert
      {{- if .Values.global.imagePullSecrets }}
      imagePullSecrets:
        {{- range .Values.global.imagePullSecrets }}

 * either express or implied. See the License for the specific language
 * governing permissions and limitations under the License.
 */
package org.codelibs.fess.es.config.cbean.ca;

import org.codelibs.fess.es.config.cbean.ca.bs.BsDataConfigCA;

/**
 * @author ESFlute (using FreeGen)
 */
public class DataConfigCA extends BsDataConfigCA {

 * either express or implied. See the License for the specific language
 * governing permissions and limitations under the License.
 */
package org.codelibs.fess.es.log.cbean.ca;

import org.codelibs.fess.es.log.cbean.ca.bs.BsFavoriteLogCA;

/**
 * @author ESFlute (using FreeGen)
 */
public class FavoriteLogCA extends BsFavoriteLogCA {

 * either express or implied. See the License for the specific language
 * governing permissions and limitations under the License.
 */
package org.codelibs.fess.es.config.cbean.ca;

import org.codelibs.fess.es.config.cbean.ca.bs.BsCrawlingInfoCA;

/**
 * @author ESFlute (using FreeGen)
 */
public class CrawlingInfoCA extends BsCrawlingInfoCA {

 * either express or implied. See the License for the specific language
 * governing permissions and limitations under the License.
 */
package org.codelibs.fess.es.config.cbean.ca;

import org.codelibs.fess.es.config.cbean.ca.bs.BsCrawlingInfoParamCA;

/**
 * @author ESFlute (using FreeGen)
 */
public class CrawlingInfoParamCA extends BsCrawlingInfoParamCA {