CERTIFICATE_VERIFY_FAILED error after OSSM 3.0 upgrade due to ENABLE_AUTO_SNI and VERIFY_CERT_AT_CLIENT default changes

Issue

After upgrading from Red Hat OpenShift Service Mesh (OSSM) 2.6 to 3.0, external HTTPS requests to internal services fail with:

upstream_reset_before_response_started{remote_connection_failure|TLS_error:|268435581:SSL routines:OPENSSL_internal:CERTIFICATE_VERIFY_FAILED}

The error occurs when the IngressGateway attempts to connect to a backend service that uses an OpenShift service CA‑generated certificate (via annotation service.beta.openshift.io/serving-cert-secret-name). The connection works when insecureSkipVerify: true is added to the corresponding DestinationRule, confirming a certificate validation problem.