IBM Cognos TM1 v9.4 custom certificate creation

Following recent news that TM1 default certificates were expiring this month, and with no fix available for version 9.4, we were left bashing our heads against the wall to work this one out. Having now fixed it, the below is the full end to end process. This is exactly how we fixed it, play with certificate contents and passwords if you wish, I can't guarantee the results. If you can't be bothered doing it yourself, scroll to the bottom for the link to the certs I have created, which you can duly import into your environment.

Note, this only covers the basic components, so you may have additional work to do after this. Also assumes you are currently using the default certificates, these ones we will create copy those exactly but with another 10 years on the expiry date. I will add that I don't know much about TM1, so probably best not to ask many questions.

Setup CA

Install 64 bit OpenSSL from https://slproweb.com/products/Win32openSSL.html

After install, create folders under root install directory;

demoCA

demoCA\certs

demoCA\crl

demoCA\newcerts

demoCA\private

in demoCA create an empty text file called index.txt

in demoCA create a file called serial (no extension) with content 1000

in command prompt type;

set openssl_conf=c:\openSSL-win64\bin\openssl.cfg

in openssl.cfg make the following edits;

under [ CA_default ]

certs                      = c:/openssl-win64/democa/certs                            # Where the issued certs are kept

database             = c:/openssl-win64/democa/index.txt    # database index file.

new_certs_dir   = c:/openssl-win64/democa/newcerts                   # default place for new certs

certificate            = c:/openssl-win64/democa/private/cacert.pem                # The CA certificate

serial                     = c:/openssl-win64/democa/serial                            # The current serial number

private_key        = c:/openssl-win64/democa/private/ca.key# The private key

#crlnumber        = $dir/crlnumber              # the current crl number (must be commented out for v1 CRL)

private_key        = c:/openssl-win64/democa/private/ca.key# The private key

default_days     = 3650                                   # how long to certify for

default_crl_days= 3650                                 # how long before next CRL

default_md        = sha1                   # use public key default MD

under [ policy_match ]

change all to optional except CommonName = supplied

under [req ]

default_bits       = 1024

default_md        = sha1

under [ req_distinguished_name ]

countryName_default                   = US

stateOrProvinceName_default  = Massachusetts

0.organizationName_default      = Applix, Inc.

organizationalUnitName                               = Applix, Inc

organizationalUnitName_default              = Applix, Inc.

commonName                                  = supplied

under [ proxy_cert_ext ]

uncomment nsCertType                                = server

Important

Note, when generating all certificates/keys use the password applix

Default answers should be correct if you have edited openssl.cfg correctly, but for the avoidance of doubt;

Country = US

State = Massachusetts

Location = Westboro

Organisation = Applix, Inc.

OU = Applix, Inc.

Create CA key/certs

In command prompt

Cd “c:\openssl-win64\bin”

Openssl genrsa –des3 –out “C:\openssl-win64\democa\private\ca.key” 1024

Openssl req –out “C:\openssl-win64\democa\private\applixca.pem” –new –x509 –extensions v3_ca –key “C:\openssl-win64\democa\private\ca.key” –days 3650

Openssl ca –gencrl –keyfile “C:\openssl-win64\democa\private\ca.key” –cert “C:\openssl-win64\democa\private\applixca.pem” –out “C:\openssl-win64\democa\private\applixcacrl.pem”

Your c:\openssl-win64\democa\private folder should now contain;

Ca.key – private key for CA certificate

applixca.pem – CA certificate

applixcacrl.pem - CRL

Create CSR & private keys

Openssl genrsa –out “C:\openssl-win64\democa\tm1admsvrcert.key” 1024

Openssl genrsa –out “c:\openssl-win64\democa\tm1svrcert.key” 1024

Openssl req –new –sha1 –key “c:\openssl-win64\democa\tm1admsvrcert.key” –out “c:\openssl-win64\democa\tm1admsvrcert.csr”

Openssl req –new –sha1 –key “c:\openssl-win64\democa\tm1svrcert.key” –out “c:\openssl-win64\democa\tm1svrcert.csr”

You should now have 4 files in c:\openssl-win64\democa\;

• Tm1admsvrcert.key
• Tm1svrcert.key
• Tm1admsvrcert.csr
• Tm1admsvrcert.csr

Sign certificates

Openssl ca –in “c:\openssl-win64\democa\tm1admsvrcert.csr” –out “c:\openssl-win64\democa\tm1admsvrcert.pem”

Openssl ca –in “c:\openssl-win64\democa\tm1admsvrcert.csr” –out “c:\openssl-win64\democa\tm1admsvrcert.pem”

Should end up with 2 more files in c:\openssl-win64\democa\:

• Tm1admsvrcert.pem
• Tm1svrcert.pem

Now open up tm1admsvrcert.pem and tm1admsvrcert.key in notepad, copy the contents of the key file into the pem file, below the existing content, and save. Repeat for tm1svrcert.pem. This will give you two pem files that include the private key.

Generate DER certificate

Openssl x509 –outform der –in “C:\openssl-win64\democa\private\applixca.pem” –out “C:\openssl-win64\democa\private\applixca.der”

Generate TM1 files

Now, on your TM1 server create a subfolder under “C:\program files\cognos\tm1\bin\ssl” called new, copy the below files there;

• Applixca.pem
• Applixca.der
• Applixcacrl.pem
• Tm1admsvrcert.pem
• Tm1svrcert.pem

In command prompt on the TM1 server;

Cd “c:\program files\cognos\tm1\bin”

Tm1crypt –pwd applix –validate

In your “c:\program files\cognos\tm1\bin” folder you should now have two new files;

• Tm1cipher.dat
• Tm1key.dat

Copy these into C:\program files\cognos\tm1\bin\ssl\new

Create Java keystore

In command prompt;

Cd “C:\program files\cognos\tm1\axajre\jre\bin”

Keytool –import –file “C:\program files\cognos\tm1\bin\ssl\new\applixca.pem” –keystore “C:\program files\cognos\tm1\bin\ssl\new\tm1store”

Update Certificates

You should now have all the files you need, so follow the below to update your setup;

Stop your TM1 services

In command prompt;

Cd “C:\program files\cognos\tm1\bin\ssl”

Importsslcert –remove

Create a folder under SSL called “old” to back up your existing files, move everything except importsslcert.exe, dh512.pem and dh1024.pem into it.

Copy the contents of “new” into the root ssl folder, you should now have

• Importsslcert.exe
• Applixca.pem
• Applixca.der
• Applixcacrl.pem
• Tm1admsvrcert.pem
• Tm1svrcert.pem
• Tm1cipher.dat
• Tm1key.dat
• Tm1store
• Dh512.pem
• Dh1024.pem

Back in command prompt;

Importsslcert.exe

Start your TM1 services

You should find it’s working, tm1server.log in your data directory should also confirm this.

And now, the bundle of files to save you the pain;

https://drive.google.com/file/d/0Bx5Jfsdt4yqIUVVtSUV5Zkx5NW8/view?usp=sharing