Bring your own CAs

AWS

Set up and store your Istio root CA in an AWS private CA issuer and use cert-manager to request and manage intermediate CA certificates for the Istio control plane.