anchor.diff:  * Install {SMProductName} with mutual TLS enabled to configure certificates.
   * This example uses the certificates from the link:https://github.com/maistra/istio/tree/maistra-{MaistraVersion}/samples/certs[Maistra repository]. For production, use your own certificates from your certificate authority.
   * Deploy the Bookinfo sample application to verify the results with these instructions.
  +* OpenSSL is required to verify certificates.
   
   [id="ossm-cert-manage-add-cert-key_{context}"]
   == Adding an existing certificate and key
   
   To use an existing signing (CA) certificate and key, you must create a chain of trust file that includes the CA certificate, key, and root certificate. You must use the following exact file names for each of the corresponding certificates. The CA certificate is named `ca-cert.pem`, the key is `ca-key.pem`, and the root certificate, which signs `ca-cert.pem`, is named `root-cert.pem`. If your workload uses intermediate certificates, you must specify them in a `cert-chain.pem` file.
   
  -Add the certificates to {SMProductShortName} by following these steps. Save the example certificates from the link:https://github.com/maistra/istio/tree/maistra-{MaistraVersion}/samples/certs[Maistra repository] locally and replace `<path>` with the path to your certificates.
  +. Save the example certificates from the link:https://github.com/maistra/istio/tree/maistra-{MaistraVersion}/samples/certs[Maistra repository] locally and replace `<path>` with the path to your certificates.
   
  -. Create a secret `cacert` that includes the input files `ca-cert.pem`, `ca-key.pem`, `root-cert.pem` and `cert-chain.pem`.
  +. Create a secret named `cacert` that includes the input files `ca-cert.pem`, `ca-key.pem`, `root-cert.pem` and `cert-chain.pem`.
   +
   [source,terminal]
   ----
  
positive.code:       istiod:
          type: PrivateKey
          privateKey:
            rootCADir:  /etc/cacerts
  ----
  
  [id="ossm-cert-manage-verify-cert_{context}"]
  == Verifying your certificates
  
  Use the Bookinfo sample application to verify your certificates are mounted correctly. First, retrieve the mounted certificates. Then, verify the certificates mounted on the pod.
  
  . Store the pod name in the variable `RATINGSPOD`.
  +
  [source,terminal]
  ----
  $ RATINGSPOD=`oc get pods -l app=ratings -o jsonpath='{.items[0].metadata.name}'`
  ----
  +
  . Run the following commands to retrieve the certificates mounted on the proxy.
  +
  [source,terminal]
  ----
  $ oc exec -it $RATINGSPOD -c istio-proxy -- /bin/cat /var/run/secrets/istio/root-cert.pem > /tmp/pod-root-cert.pem
  ----
  +
  The file `/tmp/pod-root-cert.pem` contains the root certificate propagated to the pod.
  +
  [source,terminal]
  ----
  $ oc exec -it $RATINGSPOD -c istio-proxy -- /bin/cat /etc/certs/cert-chain.pem > /tmp/pod-cert-chain.pem
  ----
  +
  The file `/tmp/pod-cert-chain.pem` contains the workload certificate and the CA certificate propagated to the pod.
  +
  . Verify the root certificate is the same as the one specified by the Operator. Replace `<path>` with the path to your certificates.
  +
  [source,terminal]
  ----
  $ openssl x509 -in <path>/root-cert.pem -text -noout > /tmp/root-cert.crt.txt
  ----
  +
  [source,terminal]
  ----
  $ openssl x509 -in /tmp/pod-root-cert.pem -text -noout > /tmp/pod-root-cert.crt.txt
  ----
  +
  [source,terminal]
  ----
  $ diff /tmp/root-cert.crt.txt /tmp/pod-root-cert.crt.txt
  ----
  +
  Expect the output to be empty.
  +
  . Verify the CA certificate is the same as the one specified by Operator. Replace `<path>` with the path to your certificates.
  +
  [source,terminal]
  ----
  $ sed '0,/^-----END CERTIFICATE-----/d' /tmp/pod-cert-chain.pem > /tmp/pod-cert-chain-ca.pem
  ----
  +
  [source,terminal]
  ----
  $ openssl x509 -in <path>/ca-cert.pem -text -noout > /tmp/ca-cert.crt.txt
  ----
  +
  [source,terminal]
  ----
  $ openssl x509 -in /tmp/pod-cert-chain-ca.pem -text -noout > /tmp/pod-cert-chain-ca.crt.txt
  ----
  +
  [source,terminal]
  ----
  $ diff /tmp/ca-cert.crt.txt /tmp/pod-cert-chain-ca.crt.txt
  ----
  +
  Expect the output to be empty.
  +
  . Verify the certificate chain from the root certificate to the workload certificate. Replace `<path>` with the path to your certificates.
  +
  [source,terminal]
  ----
  $ head -n 21 /tmp/pod-cert-chain.pem > /tmp/pod-cert-chain-workload.pem
  ----
  +
  [source,terminal]
  ----
  $ openssl verify -CAfile <(cat <path>/ca-cert.pem <path>/root-cert.pem) /tmp/pod-cert-chain-workload.pem
  ----
  +
  .Example output
  [source,terminal]
  ----
  /tmp/pod-cert-chain-workload.pem: OK
  ----
  
  [id="ossm-cert-cleanup_{context}"]
  == Removing the certificates
  
negative.code: apiVersion: maistra.io/v2
  kind: ServiceMeshControlPlane
  spec:
    security:
      dataPlane:
        mtls: true
  ----
  