When setting mTLS to true as:

  security:
    dataPlane:
      mtls: true

ServiceMesh deploys destinationrules for *.local as:

$ oc get destinationrules.networking.istio.io  -n istio-system default
NAME      HOST      AGE
default   *.local   22m

However, *.lcoal is not always correct because users can change the cluster domain.
In fact, the resource template has the following setting in another place:

spec:
  host: "kubernetes.default.svc.{{ .Values.global.proxy.clusterDomain }}"

It should use the suffix of "{{ .Values.global.proxy.clusterDomain }}" in https://github.com/maistra/istio-operator/blob/maistra-2.4/resources/helm/v2.3/mesh-config/templates/enable-mesh-mtls.yaml