Did you think about mixing Istio with standard k8s Ingresses (which is already well integrated with cert-manager)? In this case TLS termination part is maintained by a separate ingress controller.