How do I add a TLS certificate for an external REST or web service call on BAW in CP4BA (no WebSphere truststore)?

Question

A service flow calls an internal HTTPS API with a certificate from our corporate CA. On WebSphere we retrieved the signer into the cell truststore. On the Cloud Pak the call fails with a handshake error - where is the truststore now?

Answer 1

The Liberty truststore of the workflow pods is generated by the operator; you never edit it. You hand the operator the certificates, it adds them to the truststore of every pod and restarts them:

# 1. put the CA (or the server certificate chain) into a secret - key name tls.crt
oc create secret generic corp-ca-cert --from-file=tls.crt=corp-root-ca.pem -n cp4ba
# 2. reference it in the shared configuration of the CR (applies to all capabilities)
spec:
  shared_configuration:
    trusted_certificate_list:
      - corp-ca-cert
      - partner-api-cert
# 3. wait for the reconcile; verify from a workflow pod
oc exec <baw-server-pod> -- keytool -list -keystore /opt/ibm/wlp/usr/servers/defaultServer/resources/security/trusts.p12 -storepass "$(oc exec <pod> -- cat /path/to/pass)" | grep -i corp
oc exec <baw-server-pod> -- curl -sv https://api.corp.example.com/health 2>&1 | grep -E "SSL|subject|issuer" 

Notes: use the CA certificate rather than a leaf certificate so that renewals do not need a change; one secret can hold a chain (concatenated PEM); the same list is used by Studio (external service discovery from a URL), Workplace and the operator's own calls; for services inside the cluster prefer the service DNS name and the cluster CA (already trusted). If the endpoint needs a client certificate (mutual TLS), configure it in the custom Liberty configuration (<ssl> with a key store secret) or terminate mTLS in a sidecar / gateway - the process app's REST server definition has no client certificate option.

References

• CP4BA documentation - importing certificates (trusted_certificate_list)