I am intercepting a service at port 389 and applying tls-origination, so my destination rules is as follows:

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: ldap
spec:
  host: ...
  subsets:
  - name: tls-origination
    trafficPolicy:
      loadBalancer:
        simple: ROUND_ROBIN
      portLevelSettings:
      - port:
          number: 636
        tls:
          mode: SIMPLE
          caCertificates: /path/to/certificate/ldap.pem

The value /path/to/certificate/ldap.pem is the path in my local machine to the file. When I look at the istio proxy logs, after having applied the destination rules, I get the following error:

type.googleapis.com/envoy.api.v2.Cluster rejected: Error adding/updating cluster(s) outbound|636|tls-origination|...: Invalid path: /path/to/certificate/ldap.pem

What am I doing wrong? istio is being deployed inside kubernetes