Istio ingressgateway 503 upstream errors when only allow mTLS traffic

Question

I am using Istio 1.8.0 with on-prem k8s v1.19..We have several microservices running where I am using STRICT mode for peerauthentication. And I can verify that