Bug description
I've tested VM multi network mesh expansion with mTLS connection from the GKE to the VM (EC2) - the connection failed due to:

From the client (sleep-pod) logs:
TLS error: 268435581:SSL routines:OPENSSL_internal:CERTIFICATE_VERIFY_FAILED
From the server (VM) logs:
TLS error: 268436504:SSL routines:OPENSSL_internal:TLSV1_ALERT_UNKNOWN_CA

I've followed https://istio.io/docs/examples/virtual-machines/multi-network/ with some changes:

1. Wanted to caught all inbound and outbound traffic to the VM so I've set ISTIO_SERVICE_CIDR=* and ISTIO_INBOUND_PORTS=*
2. go run istio.io/istio/security/tools/generate_cert -client -host spiffee://cluster.local/vm/vmname --out-priv key.pem --out-cert cert-chain.pem -mode citadel - command didn't worked because istiod is not self-signed mode so no istio-ca-secret secret. I run the following with spiffe://cluster.local/ns/vm/sa/default - generate_cert -client -host spiffe://cluster.local/ns/vm/sa/default -signer-cert samples/certs/ca-cert.pem -signer-priv samples/certs/ca-key.pem --out-priv key.pem --out-cert cert-chain.pem -mode signer
3. Due to the fact that the VM is not on the same network as my GKE, I've added an endpoint to the serviceentry (that was created with the istioctl experimental add-to-mesh command) that will direct traffic to the ext-ip of my VM and gave him highest weight then the internal IP
4. Added a destination rule to encrypt traffic to the VM

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: vm-mtls
spec:
  host: "*.vm.svc.cluster.local"
  trafficPolicy:
    portLevelSettings:
    - port: 
        number: 80
      tls:
        mode: ISTIO_MUTUAL

Expected behavior
mtls connection from the cluster to the vm should work
Steps to reproduce the bug
Follow https://istio.io/docs/examples/virtual-machines/multi-network/ and add a destination rule to use mtls to the VM

Version (include the output of istioctl version --remote and kubectl version and helm version if you used Helm)
1.5.1

How was Istio installed?
istioctl manifest apply
-f install/kubernetes/operator/examples/vm/values-istio-meshexpansion.yaml

Environment where bug was observed (cloud vendor, OS, etc)
GKE, EC2