I am deploying OpenShift Service Mesh v2.0.8 and discovered this issue from istio is present: https://github.com/istio/istio/pull/27798.

In summary, when adding a custom certificate authority to the mesh, the cert chain file needs a newline at the end to work properly. If the newline is not present, the certs are not deployed into the envoy sidecar proxies and they hang in a "not ready" state.