How to replace the default istio CA with a plug-in certificate without redeploying

[fizos]

I have deployed the istio. And now I want to replace its default certificate with a third-party plug-in certificate, do I have to redeploy istiod? Is it possible without redeploying? Help need, thanks !

[zirain]

hope this will help you.

[fizos]

This link needs to obtain the initial certificate A when the certificate is rotated. My cluster currently uses the default certificate and includes already running workloads. How should I replace it with a third-party certificate in this scenario? My istio version It is 17.3, deployed using helm

[zirain]

what does default certificate means? the selfsigned certificate created by istio?

[fizos]

yes, the selfsigned certificate created by istio

[zirain]

maybe you can try to copy it into cacert first, then follow the rest steps.

[fizos]

According to the link steps, I was able to roll the CA from A to B normally, but when using the self-signed CA generated by istio by default as the initial state, I switched it to CA A. From istiod, the multi-root CA configuration did not take effect. , the certificate of the workload is not updated, what is the reason?

[fizos]

According from the current information, when istio is deployed, if cacerts exist, istio will not generate istio-ca-secret objects. Whether it is multi-root configuration only focuses on changes to cacerts objects. If istio-ca-secret exists, it will be ignored?