Since version 9.0.18, the products included in Control-M Application Pack run in one single Java container. This causes some significant changes.

1. Which JRE does Control-M Application Pack use?
2. What keystore is used by Control-M Application Pack to hold SSL certificates?
3. What is the default password for that keystore?
4. How do I add a new trusted CA certificate to that keystore? 
5. Is it possible to migrate the certificates from a different keystore (ex. WJM cacerts) to AI apcerts keystore?

1. Which JRE does Control-M Application Pack use?
Answer: The Control-M/Agent's JRE:
  UNIX: ~/ctm_agent/ctm/JRE/bin/java
  Windows: C:\Program Files\BMC Software\Control-M Agent\Default\JRE\

For Control-M Application Pack 9.0.18.100 and below:

2. What keystore is used by Control-M Application Pack 9.0.18 to hold SSL certificates?
Answer:
  UNIX: $CONTROLM/cm/AP/data/DATABASE/ctmdbcerts
  Windows:  $CONTROLM/CM\AP\data\DATABASE\ctmdbcerts
(note there is a known problem with the default keystore being empty, please refer to: 000148566)

3. What is the default password for that keystore?
Answer: ctmdb123

4: How do I add a new trusted CA certificate to that keystore? 
Answer: 
  UNIX: 

    cd $CONTROLM/cm/AP/exe/ 
    ./import_certificate.sh "CA-Alias" "CA-cert"
   

 Windows: 

    "C:\Program Files\BMC Software\Control-M Agent\Default\CM\AP\exe\import_certificate.bat" "CA-Alias" "CA-cert"

For Control-M Application Pack 9.0.18.200 and above:

2. What keystore is used by Control-M Application Pack 9.0.19 to hold SSL certificates?
Answer:
  UNIX: $CONTROLM/cm/AP/data/security/apcerts
  Windows:  $CONTROLM\CM\AP\data\security\apcerts

3. What is the default password for that keystore?
Answer: appass

4: How do I add a new trusted CA certificate to that keystore? 
Answer: 
  UNIX: 

    a. take a backup copy of the keystore: cp $CONTROLM/cm/AP/data/security/apcerts $CONTROLM/cm/AP/data/security/apcerts.old
    b. Import Certificate:
         keytool -import -alias "CA-Alias" -keystore  $CONTROLM/cm/AP/data/security/apcerts -file <CA.cer> -storepass appass
         where <CA.Cer> is your certificate file
    c. Restart the AP container:  $CONTROLM/cm/AP/exe/apmanager stop

 
  Windows: 

    a. Take a backup copy of the keystore copying "C:\Program Files\BMC Software\Control-M Agent\Default\CM\AP\data\security\apcerts" to "C:\Program Files\BMC Software\Control-M Agent\Default\CM\AP\data\security\apcerts.old"
    b. Import Certificate:
       keytool -import -alias "CA-Alias" -keystore  C:\Program Files\BMC Software\Control-M Agent\Default\CM\AP\data\security\apcerts -file <CA.cer> -storepass appass
       where <CA.Cer> is your certificate file
    c. Restart the AP container:  "C:\Program Files\BMC Software\Default\CM\AP\exe\apmanager" stop

The step to import a new CA certificate are listed in the following documentation page (from the Application Integrator help):
https://documents.bmc.com/supportu/9.0.20/etc/ai/help/en-US/Web_Help/index.htm#97735.htm

For informatica :
https://documents.bmc.com/supportu/9.0.20/help/Plugins/en-US/INFORMATICA/Web_Help/index.htm#98555.htm

Important note on Control-M Application Integrator 9.0.21 and above:
As of version 9.0.21 Application Integrator is no longer part of the Application Pack. To add the certificate to the AI, follow the procedure in the following link:

https://documents.bmc.com/supportu/9.0.21/en-US/Documentation/Application_Integrator_configuration.htm?Highlight=certificate#SettingUpSSLonControlMAgent

5. Is it possible to migrate the certificates from a different keystore (ex. WJM cacerts) to AI apcerts keystore?
Answer:
The cacerts keystore file used by WS CM is the same JKS type like the AI's apcerts keystore file.
There is an option to as merge the WS CM configured keystore to the AI's apcerts keystore.

Using keytool, one can perform the merge, for example:

keytool -importkeystore -srckeystore <WS CM cacerts> -destkeystore <AI apcerts> -srcstorepass <password> -deststorepass <password>

Or if one worries about conflict or overwriting certificates, then it's possible merge one certificate at a time.

The merge idea is basically doing export and import all in one step.

To merge one certificate from one keystore to another keystore, one can use:

keytool -importkeystore -srckeystore <WS CM cacerts> -destkeystore <AI apcerts> -srcalias <alias> -destalias <alias> -srcstorepass <password> -deststorepass <password>