When your cluster has an external idp configured and that idp is not using the in cluster CA, Kiali fails to perform a login to the remote cluster.

When Kiali communicates with the idp during token exchange, it should trust both the cluster CA and the system roots.