credentialName string 
The credentialName stands for a unique identifier that can be used to identify the serverCertificate and the privateKey. The credentialName appended with suffix “-cacert” is used to identify the CaCertificates associated with this server. Gateway workloads capable of fetching credentials from a remote credential store such as Kubernetes secrets, will be configured to retrieve the serverCertificate and the privateKey using credentialName, instead of using the file system paths specified above. If using mutual TLS, gateway workload instances will retrieve the CaCertificates using credentialName-cacert. The semantics of the name are platform dependent. In Kubernetes, the default Istio supplied credential server expects the credentialName to match the name of the Kubernetes secret that holds the server certificate, the private key, and the CA certificate (if using mutual TLS). Set the ISTIO_META_USER_SDS metadata variable in the gateway’s proxy to enable the dynamic credential fetching feature.

$ helm template install/kubernetes/helm/istio --name istio --namespace istio-system \
    --values install/kubernetes/helm/istio/values-istio-sds-auth.yaml | kubectl apply -f -

apiVersion: certmanager.k8s.io/v1alpha1
kind: Certificate
metadata:
  name: yyy-xxx-cert
  namespace: istio-system
spec:
  secretName: yyy-xxx-cert
  issuerRef:
    kind: ClusterIssuer
    name: letsencrypt-prod
  commonName: "*.yyy.xxx"
  dnsNames:
    - "*.yyy.xxx"
  acme:
    config:
             <your config>