IBM Support

How to Update Your Expiring TM1 SSL Certificates - Manual Steps - TM1 10.2.X - UNIX

Fix Readme


Abstract

*This document is applicable to all TM1 10.2.0 and 10.2.2 releases, regardless of FixPack or InterimFix level. However if you happen to be on TM1 10.2.2 FP4 IF1 (or higher) we would recommend that you follow the steps at the following location instead: *

If you have already implemented Custom SSL Certificates or the TM1 v2 SSL Certificates, across all TM1 Components - then no action is required. It is still suggested that you roll your test environment clock to a date beyond November 24th 2016 - and verify that all connectivity/components functions as expected.

Your TM1 SSL Certificates will expire on November 24th. If you use TM1 10.2.X, follow these steps to ensure you do not experience an outage! Failure to take action will result in your TM1 Environment being completely inaccessible November 24 2016.

Content

BEFORE YOU BEGIN:

-Please ensure that you have already reviewed all of the relevant detail on the following page before you proceed: IBM Cognos TM1 SSL Expiration - Manual Fix Approach - Landing Page
http://www-01.ibm.com/support/docview.wss?uid=swg21991653

-Do NOT confuse having custom certificates in your WebTier, as the solution. It is very possible that your WebTier had been configured for custom FRONT END / WEB certificates - and is still relying on the default TM1/APPLIX certificates for TM1 Server communication

-If your IBM Cognos TM1 environment uses a custom application server (such as Websphere), you will want to ensure you inquire with your AppServer Administrator to ensure all keystores are updated accordingly.

-If your IBM Cognos TM1 environment is distributed (server components residing on different servers), be sure to follow the appropriate steps for the appropriate components.

-All steps assume you are using a 64bit architecture. If you are using a 32bit installation of TM1, substitute all \bin64\ references, for \bin\

-If your IBM Cognos TM1 environment communicates with any other services secured by SSL (for example but not limited to, an SSL Secured Cognos BI Dispatcher for CAM Authentication) you will be required to re-import all required certificates in to the tm1store using the keytool commands found in Step7.

-It is advised that all customers verify not only that these steps work in a test environment (prior to any production changes), but that the server clocks be rolled ahead past November 24th 2016 to ensure that the product behaves as expected post expiration date.

-If you have questions, please log a service request with TM1 Support so that the problem can be addressed.

  1. Download the updated TM1 SSL Certificates from the following location: http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FInformation+Management%2FCognos+TM1&fixids=BA-CTM1-SSL-ZIP-IF001
  2. Stop all IBM Cognos TM1 Services in the environment you are updating
  3. Extract the downloaded file/archive and extract it to any directory. For the purpose of this document, our files will be extracted in to <tm1_install_dir>/tm1_64/NewSSLCerts/
  4. After extracting the files, look inside of your extracted folder <tm1_install_dir>/tm1_64/NewSSLCerts/ . The following files should be present.
    • applixca.der
    • applixca.pem
    • applixcacrl.p7b
    • applixcacrl.pem
    • tm1admsvrcert.pem
    • tm1store
    • tm1svrcert.pem
  5. Back up the following directories in your <tm1_install_dir>
    • <tm1_install_dir>/tm1_64/bin64/ssl
    • <tm1_install_dir>/tm1_64/webapps/pmpsvc/WEB-INF/bin64/ssl
  6. Copy the contents of the folder you extracted earlier <tm1_install_dir>/tm1_64/NewSSLCerts/ , and place them inside of the 2 directories listed above in Step 4. During this process, you will be required to REPLACE all conflicting files as we must replace the old certificate files with new ones.
  7. Navigate to <path_to_your_jre>/bin . Execute the following command:
    • ./keytool -delete -alias applixca -keystore ../lib/security/cacerts -storepass changeit
      **If you have not previously added the applixca certificate to the keystore, then you may get an error indicating that the alias does not exist. This is OK as the next step will perform the import.
    • ./keytool -import -trustcacerts -file <tm1_install_dir>/bin64/ssl/applixca.pem -alias applixca -keystore ../lib/security/cacerts -storepass changeit -v -noprompt
    • ./keytool -delete -alias applixca -keystore <tm1_install_dir>/bin64/pmpsvcTrustStore -storepass changeit
      **This file only exists if your TM1 Application Server had been started previously. If it had not, then this file does not exist - therefore the certificate can not be removed. If this file does not exist, skip this step - AND - skip the next step (the import will not be required, and will be performed automatically once you start your TM1 Application Server for the first time)
    • ./keytool -import -trustcacerts -file <tm1_install_dir>/bin64/ssl/applixca.pem -alias applixca -keystore <tm1_install_dir>\bin64\pmpsvcTrustStore -storepass changeit -v -noprompt

      *Note that your JRE location or password may have been changed during your installation and configuration. If the above does not work you will want to consult with whomever may have performed the installation and configuration of your environment.
  8. Navigate to and copy all libngtm1*.so files from your <tm1_install_dir>\webapps\pmpsvc\WEB-INF\bin64\ directory
  9. Paste the libngtm1*.so files on your clipboard, in to your <tm1_install_dir>\bin64\ directory. If prompted, REPLACE/OVERWRITE any conflicting files (specifically the libngtm1api.so)
  10. Navigate to <tm1_install_dir>/bin64/ and open/edit the startup_pmpsvc.sh file
    • From the top, find the first line beginning with 'CATALINA_OPTS='
    • Append the following to the end of the string, but before the closing double-quote: -Dcom.ibm.cognos.tm1.bin=$TM1_BIN
      ***Use $TM1_BIN as is, you are not expected to modify this variable as it sets itself via the script. Ensure that you have placed a 'space' as the first character before the -Dcom.. string
    • Save your changes and close the startup_pmpsvc.sh file
  11. Navigate to <tm1_install_dir>/tm1_64/bin64/
  12. Start your IBM Cognos TM1 Services

At this stage, all IBM Cognos TM1 Server-side components have been updated to use the new TM1 Certificates - and are no longer are risk of ticket expiration. If you wish to confirm, you may roll ahead your computer date/time, and recycle your TM1 Services - to know for sure that you are able to function on a date post November 24 2016.

Related Information

[{"Product":{"code":"SS9RXT","label":"Cognos TM1"},"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Component":"TM1","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF016","label":"Linux"}],"Version":"10.2;10.2.2","Edition":"All Editions","Line of Business":{"code":"LOB10","label":"Data and AI"}}]

Document Information

Modified date:
15 June 2018

UID

swg21991549