Steps

TM1 SSL Certificate Generation - ApplixCA - Instructions

This document provides a script and/or step-by-step manual instructions for generating and deploying new applixca TM1 SSL certificates.  The script can be used to automate the generation of new certificates.  The manual steps are available to help with an understanding of the steps that the script has automated.

Prerequisites

1. Download and Install OpenSSL

Download Win64 OpenSSL v4.0.1 from:
https://slproweb.com/products/Win32OpenSSL.html

Install to the default location: C:\Program Files\OpenSSL-Win64

The OpenSSL executable will be located at: C:\Program Files\OpenSSL-Win64\bin\openssl.exe

2. Other Requirements

• Administrative access to TM1 installation directories
• TM1 services stopped before beginning

Important Notes

• Password for CA key: applix
• Password for Java cacerts: changeit
• Password for tm1store: applix
• All commands should be run from a Command Prompt with administrative privileges

Automated Script:

For automated execution of these steps, use the included update-applixca-certs.bat script. The script performs all the above steps. To run the automated script:

1. Download the update-applixca-certs.bat file here
2. Place the update-applixca-certs.bat file in C:\Program Files\OpenSSL-Win64\bin\ 
3. Open Command Prompt as Administrator
4. Navigate to the C:\Program Files\OpenSSL-Win64\bin\ directory
5. Run: update-applixca-certs.bat
6. Follow the prompts to specify your TM1 SSL directory path, default C:\Program Files\ibm\cognos\tm1_64\bin64\ssl
7. After certificates have been generated, the updated ssl folder will need to be provided to any users of Architect / Perspectives
8. If using distributed installs, the updated ssl folders will need to be copied to additional installation directories
   1. Ensure all ssl folders are updated, including tm1store and cacerts files

Manual Instructions (what the automated script does):

Step 1: Set Environment Variables and Working Directory

1. Open Command Prompt as Administrator

2. Set the TM1_ROOT environment variable (replace with your actual TM1 installation path):

   set "TM1_ROOT=C:\Program Files\ibm\cognos\tm1_64"

3. Verify tm1sd.exe exists in the bin64 directory:

   dir "%TM1_ROOT%\bin64\tm1sd.exe"

4. Navigate to the OpenSSL bin directory (this will be your working directory):

   cd "C:\Program Files\OpenSSL-Win64\bin"

Note: The TM1_ROOT environment variable will be used in all subsequent commands. From this root path, the following paths are derived:

• bin64 directory: %TM1_ROOT%\bin64
• bin64 SSL: %TM1_ROOT%\bin64\ssl
• bin SSL: %TM1_ROOT%\bin\ssl
• Webapps SSL: %TM1_ROOT%\webapps\pmpsvc\WEB-INF\bin64\ssl
• Java keytool: %TM1_ROOT%\bin64\jre\7.0\bin\keytool.exe
• Java cacerts: %TM1_ROOT%\bin64\jre\7.0\lib\security\cacerts

Step 2: Backup Existing SSL Directories

Create backups of all SSL directories before making changes:

xcopy "%TM1_ROOT%\bin64\ssl" "%TM1_ROOT%\bin64\ssl_bkp\" /E /I /H /Y
xcopy "%TM1_ROOT%\bin\ssl" "%TM1_ROOT%\bin\ssl_bkp\" /E /I /H /Y
xcopy "%TM1_ROOT%\webapps\pmpsvc\WEB-INF\bin64\ssl" "%TM1_ROOT%\webapps\pmpsvc\WEB-INF\bin64\ssl_bkp\" /E /I /H /Y

Step 3: Delete Old Certificate Files

Delete the following files from the bin64\ssl directory:

del /q "%TM1_ROOT%\bin64\ssl\tm1admsvrcert.pem"
del /q "%TM1_ROOT%\bin64\ssl\tm1svrcert.pem"
del /q "%TM1_ROOT%\bin64\ssl\applixca.pem"
del /q "%TM1_ROOT%\bin64\ssl\applixca.der"
del /q "%TM1_ROOT%\bin64\ssl\applixca.crl"

Step 4: Create Certificate Authority (CA) Directory Structure

Create the CA structure in the OpenSSL bin directory (you should already be here from Step 1):

mkdir applixCA
mkdir applixCA\private
mkdir applixCA\newcerts
echo. > applixCA\index.txt
echo 01 > applixCA\serial

Step 5: Generate CA Private Key

Generate the CA private key (password: applix). Since you're in the OpenSSL bin directory, use openssl.exe directly:

openssl.exe genrsa -des3 -out applixCA\private\applixcakey.pem -passout pass:applix 2048

Step 6: Generate CA Certificate

Create the CA certificate (password: applix):

openssl.exe req -new -x509 -days 3650 -key applixCA\private\applixcakey.pem -out applixCA\applixca.pem -subj "/C=US/ST=State/L=City/O=Organization/OU=Unit/CN=TM1 CA" -passin pass:applix

Step 7: Convert CA Certificate to DER Format

Convert the PEM certificate to DER format:

openssl.exe x509 -in applixCA\applixca.pem -outform DER -out applixCA\applixca.der

Step 8: Generate TM1 Server Certificate

Create the TM1 server certificate and key (password: applix):

openssl.exe req -new -nodes -out tm1svrcert.csr -keyout tm1svrcert.key -subj "/C=US/ST=State/L=City/O=Organization/OU=Unit/CN=localhost"

openssl.exe x509 -req -in tm1svrcert.csr -CA applixCA\applixca.pem -CAkey applixCA\private\applixcakey.pem -CAcreateserial -out tm1svrcert.crt -days 3650 -passin pass:applix

type tm1svrcert.crt tm1svrcert.key > tm1svrcert.pem

del tm1svrcert.csr
del tm1svrcert.crt
del tm1svrcert.key

Step 9: Generate TM1 Admin Server Certificate

Create the TM1 admin server certificate and key (password: applix):

openssl.exe req -new -nodes -out tm1admsvrcert.csr -keyout tm1admsvrcert.key -subj "/C=US/ST=State/L=City/O=Organization/OU=Unit/CN=localhost"

openssl.exe x509 -req -in tm1admsvrcert.csr -CA applixCA\applixca.pem -CAkey applixCA\private\applixcakey.pem -CAcreateserial -out tm1admsvrcert.crt -days 3650 -passin pass:applix

type tm1admsvrcert.crt tm1admsvrcert.key > tm1admsvrcert.pem

del tm1admsvrcert.csr
del tm1admsvrcert.crt
del tm1admsvrcert.key

Step 10: Create Certificate Revocation List (CRL)

Generate an empty CRL file (password: applix):

openssl.exe ca -gencrl -keyfile applixCA\private\applixcakey.pem -cert applixCA\applixca.pem -out applixCA\applixcacrl.pem -config nul -passin pass:applix

If this fails, create a basic empty CRL:

echo -----BEGIN X509 CRL----- > applixCA\applixcacrl.pem
echo -----END X509 CRL----- >> applixCA\applixcacrl.pem

Step 11: Copy Certificates to TM1 SSL Directories

Copy all generated certificates from the OpenSSL bin directory to the TM1 SSL directories:

To bin64\ssl:

copy /y applixCA\applixca.pem "%TM1_ROOT%\bin64\ssl\applixca.pem"
copy /y applixCA\applixca.der "%TM1_ROOT%\bin64\ssl\applixca.der"
copy /y applixCA\applixcacrl.pem "%TM1_ROOT%\bin64\ssl\applixcacrl.pem"
copy /y tm1svrcert.pem "%TM1_ROOT%\bin64\ssl\tm1svrcert.pem"
copy /y tm1admsvrcert.pem "%TM1_ROOT%\bin64\ssl\tm1admsvrcert.pem"

To bin\ssl (if exists):

copy /y applixCA\applixca.pem "%TM1_ROOT%\bin\ssl\applixca.pem"
copy /y applixCA\applixca.der "%TM1_ROOT%\bin\ssl\applixca.der"
copy /y applixCA\applixcacrl.pem "%TM1_ROOT%\bin\ssl\applixcacrl.pem"
copy /y tm1svrcert.pem "%TM1_ROOT%\bin\ssl\tm1svrcert.pem"
copy /y tm1admsvrcert.pem "%TM1_ROOT%\bin\ssl\tm1admsvrcert.pem"

To webapps SSL:

copy /y applixCA\applixca.pem "%TM1_ROOT%\webapps\pmpsvc\WEB-INF\bin64\ssl\applixca.pem"
copy /y applixCA\applixca.der "%TM1_ROOT%\webapps\pmpsvc\WEB-INF\bin64\ssl\applixca.der"
copy /y applixCA\applixcacrl.pem "%TM1_ROOT%\webapps\pmpsvc\WEB-INF\bin64\ssl\applixcacrl.pem"
copy /y tm1svrcert.pem "%TM1_ROOT%\webapps\pmpsvc\WEB-INF\bin64\ssl\tm1svrcert.pem"
copy /y tm1admsvrcert.pem "%TM1_ROOT%\webapps\pmpsvc\WEB-INF\bin64\ssl\tm1admsvrcert.pem"

Step 12: Update Java cacerts Keystore

Update the Java cacerts keystore with the new CA certificate (password: changeit):

cd "%TM1_ROOT%\bin64\jre\7.0\bin"

REM Remove existing applixca alias (ignore errors if not present)
keytool.exe -delete -alias applixca -keystore "..\lib\security\cacerts" -storepass changeit

REM Import new CA certificate
keytool.exe -import -trustcacerts -noprompt -file "%TM1_ROOT%\bin64\ssl\applixca.pem" -keystore "..\lib\security\cacerts" -storepass changeit -alias applixca

Find and Update All Other cacerts Files

Search for all cacerts files in the TM1 installation (excluding backups):

cd "%TM1_ROOT%"
dir /s /b cacerts | findstr /v /i "_bkp\ _backup\ backup\"

For each cacerts file found (other than the one just updated), copy the updated cacerts:

copy /y "%TM1_ROOT%\bin64\jre\7.0\lib\security\cacerts" "path\to\other\cacerts"

Step 13: Update tm1store Keystore

Update the tm1store keystore with the new CA certificate (password: applix):

cd "%TM1_ROOT%\bin64\jre\7.0\bin"

REM Remove existing applixca alias (ignore errors if not present)
keytool.exe -delete -alias applixca -keystore "%TM1_ROOT%\bin64\ssl\tm1store" -storepass applix

REM Import new CA certificate
keytool.exe -import -trustcacerts -noprompt -file "%TM1_ROOT%\bin64\ssl\applixca.pem" -keystore "%TM1_ROOT%\bin64\ssl\tm1store" -storepass applix -alias applixca

Find and Update All Other tm1store Files

Search for all tm1store files in the TM1 installation (excluding backups):

cd "%TM1_ROOT%"
dir /s /b tm1store | findstr /v /i "_bkp\ _backup\ backup\"

For each tm1store file found (other than the one just updated), copy the updated tm1store:

copy /y "%TM1_ROOT%\bin64\ssl\tm1store" "path\to\other\tm1store"

Step 14: Replace All SSL Folders

Search for all SSL folders in the TM1 installation (excluding backups):

cd "%TM1_ROOT%"
dir /s /b /ad ssl | findstr /v /i "_bkp\ _backup\ backup\"

For each SSL folder found (other than bin64\ssl which is the source):

1. Create a timestamped backup:

   xcopy "path\to\ssl\folder" "path\to\ssl\folder_bkp_YYYYMMDD_HHMM\" /E /I /H /Y

2. Copy updated certificates to the folder:

   xcopy "%TM1_ROOT%\bin64\ssl\*.*" "path\to\ssl\folder\" /Y

Step 15: Restart TM1 Services

After all certificates are deployed, restart your TM1 services

Verification

After completing all steps:

1. Verify certificates are present in all SSL directories
2. Ensure any distributed server or client installs have been updated with the newly generated certificates
3. Test TM1 connections to ensure SSL is working properly

Troubleshooting

OpenSSL Command Not Found

• Ensure Win64 OpenSSL v4.0.1 is installed from https://slproweb.com/products/Win32OpenSSL.html
• Verify installation at: C:\Program Files\OpenSSL-Win64\bin\openssl.exe
• All commands in this document use the full path to openssl.exe

Permission Denied Errors

• Run Command Prompt as Administrator
• Ensure TM1 services are stopped before modifying files

Certificate Import Failures

• Verify the certificate file exists and is readable
• Check that passwords are correct
• Ensure keystore files are not corrupted

Services Won't Start

• Check TM1 logs for SSL-related errors
• Verify certificate files are in the correct locations
• Ensure certificate and key formats are correct

Enabling SSL Debug Logging

TM1 Admin Server:

• Edit %TM1_ROOT%\bin64\tm1admsrv-log.properties

• Update the rootLogger and logger sections from INFO to DEBUG:

  log4j.rootLogger=DEBUG, R1
  log4j.logger.TM1=DEBUG

• SSL debug logging is written to tm1admsrv_<datetimestamp>.log files in the bin64 directory

TM1 Server:

• Configure tm1s-log.properties file (located in same directory as tm1s.cfg)

• Add the following line:

  log4j.logger.TM1.Comm.SSL=DEBUG

• If file doesn't exist, copy from sample directory:

  copy "%TM1_ROOT%\samples\tm1\PlanSamp\tm1s-log.properties" "path\to\your\tm1server\tm1s-log.properties"

• No restart required - changes take effect immediately
• SSL debug logging is written to tm1server.log file