Point Envoy's Upstream TLS Context at Its In-Container CA Bundle

For TLS originated by a dynamic forward-proxy cluster, configure trusted_ca on that cluster while retaining destination SAN verification.

transport_socket:
  name: envoy.transport_sockets.tls
  typed_config:
    "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
    common_tls_context:
      validation_context:
        trusted_ca:
          filename: /etc/envoy/trust/upstream-ca.pem

Merge this with the dynamic forward-proxy cluster's configuration. The approved bundle path must be readable by the running Envoy process. In Kubernetes, inspect the mounted file inside the container; a certificate installed only on the worker node does not provide it.

Include the required CA through the deployment's trust-material process, and confirm the destination supplies needed intermediates. Apply changes through the selected configuration or secret-update mechanism.

The documented dynamic forward-proxy TLS setup supplies SNI and hostname SAN verification for the resolved host. Keep that identity check alongside chain validation.

A successful wget request can use another trust source. This input covers Envoy-originated TLS; in a plain CONNECT relay, the application remains the TLS client validating the destination.

Allakkat attuumassuteqartut