Configure Cognos TM1 Performance Modeler to use custom certificates

If the Data Tier is configured to use custom certificates, you can enable custom certificates for IBM Cognos TM1 Performance Modeler.

About this task

The following setup is assumed:

  • TM1 Performance Modeler is installed in <pa_install_directory>/perfmodeler.
  • <CMS_Keystore> is the name of the CMS keystore containing all CA certificates, intermediate and root, which form the chain of trust for any certificate presented by TM1 Admin servers and TM1 Server instances.

    The keystore can be created using the gsk8capicmd tool, or copied from a Data Tier install. Typically this keystore will consist of at least two files, <CMS_Keystore>.kdb and <CMS_Keystore>.sth. The file <CMS_Keystore>.crl is optional and depends on how the keystore was created.

  • The machine where TM1 Performance Modeler is installed can connect to the Application Tier URL and the Data Tier.

Procedure

  1. Close TM1 Performance Modeler if it is running.
  2. Copy the CMS keytore file <CMS_Keystore>.* to a location on the PM computer.
    A best practice is to use a custom name for the keystore and store it outside of <pa_install_directory>/perfmodeler to prevent unintended overwriting. Create a separate folder such as c:\pa_certs. <PA_CERTS> denotes the absolute path to this folder in the following steps.
  3. In <PA_CERTS>, create a text file named of tm1api.config and paste the following contents: 
    [tm1api]
keystorefile=<PA_CERTS>\<CMS_Keystore>.kdb
keystashfile=<PA_CERTS>\<CMS_Keystore>.sth

    For example:

    [tm1api]
keystorefile=c:\pa_certs\PA2.kdb
keystashfile=c:\pa_certs\PA2.sth
    Important: Ensure the local users group has read and execute permission on the file referenced in keystashfile. By default, this file is readable only for the account that created it.
  4. Copy the <PA_CERTS>\tm1api.config file to the following locations, where xxxx denotes a version number.
    • <pa_install_directory>\perfmodeler\bins\bin_xxxx\tm1\bin
    • <pa_install_directory>\perfmodeler\bins\bin_xxxx\tm1\bin\tm1api101
    • <pa_install_directory>\perfmodeler\bins\bin_xxxx\tm1\bin\tm1api102
    • <pa_install_directory>\perfmodeler\plugins\com.cognos.pmta.tm1.distributed.bin.win32.x86_64_xxxx\extract_bin\tm1\bin
    • <pa_install_directory>\perfmodeler\plugins\com.cognos.pmta.tm1.distributed.bin.win32.x86_64_xxxx\extract_bin\tm1\bin\tm1api101
    • <pa_install_directory>\perfmodeler\plugins\com.cognos.pmta.tm1.distributed.bin.win32.x86_64_xxxx\extract_bin\tm1\bin\tm1api102
  5. Start Cognos TM1 Performance Modeler.
  6. Enter the URL for the IBM Cognos TM1 system and click Log on as.
  7. When you are prompted for the security certificate, select Trust this certificate and click OK.
    Connect to the TM1 Server.
    For example, Planning Sample.