Importing the Content Assistant certificate into containerized Content Platform Engine deployments

To integrate the Content Assistant with your FileNet Content Manager container environment, you must first import the Content Assistant Transport Layer Security (TLS) certificate in Privacy Enhanced Mail (PEM) format. Then, add the certificate into the operator trust list of the FileNet Content Manager stand-alone operator or CP4BA Content operator depending on your deployment type.

About this task

The FNCM custom resource includes the shared configuration parameter trusted_certificate_list, which contains a list of certificates for external services that connect securely with the Content Platform Engine. You need to include the Content Assistant certificate within the list of certificates for this parameter.

Based on how you deployed FileNet Content Manager in a container environment, refer to the appropriate custom resource section:

For FileNet Content Manager deployments in a stand-alone container environment, refer to Shared configuration section in the FNCM custom resource.
For FileNet Content Manager deployments in a CP4BA environment, refer to Shared configuration section in the CP4BA custom resource.

Procedure

Get the Content Assistant root certificate.
1. Access your Content Assistant SaaS service URL using a browser.
  The Content Assistant SaaS service URL has the following format:
```
https://filenetai.saas.ibm.com/prod
```
2. Download the Content Assistant root certificate in .pem format.
  Refer to the browser documentation to download the save the certificate.
3. Create a secret for the certificate that you downloaded in step 1b.
  Run the following command to import the Content Assistant root certificate into the namespace for your FNCM container deployment:
```
kubectl create secret generic cas-root-ca --from-file=tls.crt=rootCA.crt -n <your_fncm_namespace>
```
Add the secret to the shared configuration parameter trusted_certificate_list in the FNCM or CP4BA custom resource for your deployment.
For example, the updated custom resource looks like the following:
```
shared_configuration:
  trusted_certificate_list:
    - cas-root-ca
```
Restart the Content Platform Engine pod.
Optional: Check the certificates in the FNCM truststore.
The following command lists the certificates in the FNCM default truststore.
```
keytool -v -list -storepass <your_keystore_password> -keystore /shared/tls/truststore/pkcs12/trusts.p12
```
where <your_keystore_password> can be obtained from the keystorePassword parameter in the ibm-fncm-secret.