When enabling mutual tls via destinationrule, connections are dropped

I am using our service mesh workshop and noticed a weird number of errors being reported in Kiali when testing the mutual TLS lab.

{{apiVersion: "networking.istio.io/v1alpha3"
kind: "DestinationRule"
metadata:
name: "preference-destination-rule"
spec:
host: "preference"
trafficPolicy:
tls:
mode: ISTIO_MUTUAL}}

This destination rule almost immediately results in connections being dropped when trying to reach the preference service:

upstream connect error or disconnect/reset before headers. reset reason: connection termination