To enable IBM Cloud Pak for Data to validate and trust internal servers that use custom TLS certificates, the platform's truststore must be updated with the company's custom Certificate Authority (CA) certificate. The official and documented procedure for this is to create a Kubernetes ConfigMap. This ConfigMap, typically named connection-ca-certs, holds the public CA certificate(s). The platform's services are configured to mount this ConfigMap and add the certificate to their truststores, allowing them to establish secure, validated connections to the internal servers.

A. A wildcard certificate is a server-side certificate for securing multiple subdomains, not a CA certificate used for validating other certificates.

B. The platform only needs the root and intermediate CA certificates to establish a chain of trust, not the specific certificate chains for every internal server.

C. While Secrets are used for sensitive data like private keys, the public part of a CA certificate is not secret and is distributed using a ConfigMap per IBM's documentation.

1. IBM Cloud Pak for Data 4.8 Documentation

"Importing a CA certificate on the Cloud Pak for Data platform." This official guide explicitly states: "To ensure that Cloud Pak for Data services can successfully connect to an internal service that uses a custom certificate

create a configmap called connection-ca-certs and add the CA certificate for the internal service to the configmap." It provides the exact oc create configmap command to perform this action.

2. IBM Cloud Pak for Data 4.8 Documentation

"Security and compliance." The section on managing certificates details the use of ConfigMaps for distributing public certificates and Secrets for private keys

reinforcing the correct use case for each Kubernetes object in the platform's security architecture.