Answer
From around IFS Cloud 22.2.4 onward, there's a built-in option directly on the Routing Address screen to import a certificate — this avoids needing keytool/truststore filesystem access entirely, which isn't available in managed Cloud environments anyway. Check the Routing Address configuration for that import-certificate option before assuming you need container-level access to trust a third-party certificate for a Transport Connector.