How to add a new CA cert to the Istio Trust Store

I have attempted to get that working on 1.7. I cant get it to work - I can get MTLS in the mesh working outbound to the egreess gate and then on to RDS with out SSL, but when I try and add the SSL in the final hop (destination rule) it breaks the connection, the cert is correct as I have tested it. I detailed the problem here but no bytes yet.