D is correct for a customer-supplied, already-issued certificate. HPE AI Essentials presents its external TLS identity through the Istio ingress gateway, and the relevant certificate material is held in the ingress-cert secret in the istio-system namespace. When performing the manual replacement workflow, the administrator replaces the existing ingress certificate secret with one populated from the supplied certificate, private key, and CA chain according to HPE’s documented format.

Option A is incorrect because the certificate is not installed on a single UI virtual machine; HPE AI Essentials is a Kubernetes-based platform and ingress TLS is handled at the cluster ingress layer. Option B confuses certificate issuance with certificate installation. A ClusterIssuer is appropriate when cert-manager should request and renew a certificate, but the customer has already supplied the signed certificate and key. Option C incorrectly places TLS management in Keycloak.

Rev. 26.21 updated the certificate procedures for HPE AI Essentials 1.9 and later, so administrators should follow the version-specific HPE commands and secret format rather than an older generic Kubernetes recipe.

References/topics: Advanced HPE Compute Solutions, Rev. 26.21, Module 3 “Replacing the Istio ingress gateway certificate”; HPE AI Essentials documentation, manual certificate replacement and ingress-cert access.