This SSL certificate expiry issue is a recurring challenge for TM1 10.2.2 environments, especially where upgrading is not feasible due to legacy VBA dependencies. IBM has now published an updated technote specifically to address certificate generation for 10.2.2:

🔗 IBM Support Technote – Updated SSL Certificate Generation for TM1 10.2.2

Key steps outlined in the technote:

·         Download updated scripts provided by IBM for generating new certificates compatible with TM1 10.2.2.

·         Run the certificate utility to create a fresh keystore and truststore.

·         Replace expired certificates in your TM1 installation directories (bin64\ssl and related folders).

·         Restart TM1 services to apply the changes.

This approach ensures you generate valid certificates without relying on shared/public ones, which IBM no longer provides for older versions. The technote also includes troubleshooting notes for common errors during certificate replacement.

👉 Recommendation: Follow the technote step‑by‑step in your PRD environment. If you have multiple servers, repeat the process consistently across all nodes to avoid mismatched trust issues.

Microsoft Copilot Analysis: The new technote is IBM's official path forward for TM1 10.2.2 SSL renewals. Unlike earlier years where IBM distributed public certificates, the current guidance requires generating your own using the provided scripts. This ensures compliance and stability in production environments that cannot upgrade.

Hello,

One of our customer still running TM1 9.5.2 for history data in parallel to new PAL.

I tried 10.2.2 manual with some modifications to adjust TM1 9.5.2 JRE paths but TM1 still fails to connect to TM1 admin server.  

I'll appreciate any help creating new certs for TM1 9.5.2.

Thank you

Gabi

This SSL certificate expiry issue is a recurring challenge for TM1 10.2.2 environments, especially where upgrading is not feasible due to legacy VBA dependencies. IBM has now published an updated technote specifically to address certificate generation for 10.2.2:

🔗 IBM Support Technote – Updated SSL Certificate Generation for TM1 10.2.2

Key steps outlined in the technote:

·         Download updated scripts provided by IBM for generating new certificates compatible with TM1 10.2.2.

·         Run the certificate utility to create a fresh keystore and truststore.

·         Replace expired certificates in your TM1 installation directories (bin64\ssl and related folders).

·         Restart TM1 services to apply the changes.

This approach ensures you generate valid certificates without relying on shared/public ones, which IBM no longer provides for older versions. The technote also includes troubleshooting notes for common errors during certificate replacement.

👉 Recommendation: Follow the technote step‑by‑step in your PRD environment. If you have multiple servers, repeat the process consistently across all nodes to avoid mismatched trust issues.

Microsoft Copilot Analysis: The new technote is IBM's official path forward for TM1 10.2.2 SSL renewals. Unlike earlier years where IBM distributed public certificates, the current guidance requires generating your own using the provided scripts. This ensures compliance and stability in production environments that cannot upgrade.

Hello Gabi,

Running TM1 9.5.2 alongside PAL is indeed challenging, especially since IBM no longer provides public SSL certificates for legacy versions. The certificate utilities introduced for TM1 10.2.2 are not directly compatible with 9.5.2, which is why your adjustments to JRE paths still fail to connect to the Admin Server.

🔑 Key Considerations:

·         TM1 9.5.2 uses an older GSKit/JRE implementation that does not support the newer certificate generation scripts.

·         IBM has officially ended support for 9.5.2, so there are no updated public certificates available.

·         Attempting to reuse the 10.2.2 scripts requires significant manual modification of keystore/truststore paths, but even then, compatibility is not guaranteed.

🛠️ Possible Workarounds:

·         Generate self‑signed certificates using GSKit bundled with TM1 9.5.2. You can run gsk7cmd to create a new keystore and truststore, then replace the expired files in bin\ssl.

·         Align JRE paths carefully with the Admin Server configuration. TM1 9.5.2 expects specific directory structures, so mismatches cause connection failures.

·         Test with loopback certificates for internal use only, if external connectivity is not required.

·         Consider PAL migration for historical data access. While not ideal, moving legacy cubes into PAL avoids recurring SSL expiry issues.

⚠️ Important Note: IBM's current guidance (via the 10.2.2 technote) does not extend to 9.5.2. For production stability, the only sustainable path is either generating your own certificates with GSKit or migrating the historical environment into PAL.

Microsoft Copilot Analysis: For TM1 9.5.2, there is no official IBM‑issued certificate renewal process anymore. The practical solution is to generate self‑signed certificates using GSKit, but this requires careful alignment of keystore/truststore paths. Long‑term, consolidating historical data into PAL is the recommended approach to avoid repeated SSL outages.

Hello,

One of our customer still running TM1 9.5.2 for history data in parallel to new PAL.

I tried 10.2.2 manual with some modifications to adjust TM1 9.5.2 JRE paths but TM1 still fails to connect to TM1 admin server.  

I'll appreciate any help creating new certs for TM1 9.5.2.

Thank you

Gabi

This SSL certificate expiry issue is a recurring challenge for TM1 10.2.2 environments, especially where upgrading is not feasible due to legacy VBA dependencies. IBM has now published an updated technote specifically to address certificate generation for 10.2.2:

🔗 IBM Support Technote – Updated SSL Certificate Generation for TM1 10.2.2

Key steps outlined in the technote:

·         Download updated scripts provided by IBM for generating new certificates compatible with TM1 10.2.2.

·         Run the certificate utility to create a fresh keystore and truststore.

·         Replace expired certificates in your TM1 installation directories (bin64\ssl and related folders).

·         Restart TM1 services to apply the changes.

This approach ensures you generate valid certificates without relying on shared/public ones, which IBM no longer provides for older versions. The technote also includes troubleshooting notes for common errors during certificate replacement.

👉 Recommendation: Follow the technote step‑by‑step in your PRD environment. If you have multiple servers, repeat the process consistently across all nodes to avoid mismatched trust issues.

Microsoft Copilot Analysis: The new technote is IBM's official path forward for TM1 10.2.2 SSL renewals. Unlike earlier years where IBM distributed public certificates, the current guidance requires generating your own using the provided scripts. This ensures compliance and stability in production environments that cannot upgrade.

Hello Saif,

I tried to find old TM1 9.5.2 documentation to figure out how to use GSkit and generate new certificates with no luck.

I assume creating custom certificates signed by org CA and replace the self signed certs should be documented somewhere and might be easier.

Thank you,

Gabi

Hello Gabi,

Running TM1 9.5.2 alongside PAL is indeed challenging, especially since IBM no longer provides public SSL certificates for legacy versions. The certificate utilities introduced for TM1 10.2.2 are not directly compatible with 9.5.2, which is why your adjustments to JRE paths still fail to connect to the Admin Server.

🔑 Key Considerations:

·         TM1 9.5.2 uses an older GSKit/JRE implementation that does not support the newer certificate generation scripts.

·         IBM has officially ended support for 9.5.2, so there are no updated public certificates available.

·         Attempting to reuse the 10.2.2 scripts requires significant manual modification of keystore/truststore paths, but even then, compatibility is not guaranteed.

🛠️ Possible Workarounds:

·         Generate self‑signed certificates using GSKit bundled with TM1 9.5.2. You can run gsk7cmd to create a new keystore and truststore, then replace the expired files in bin\ssl.

·         Align JRE paths carefully with the Admin Server configuration. TM1 9.5.2 expects specific directory structures, so mismatches cause connection failures.

·         Test with loopback certificates for internal use only, if external connectivity is not required.

·         Consider PAL migration for historical data access. While not ideal, moving legacy cubes into PAL avoids recurring SSL expiry issues.

⚠️ Important Note: IBM's current guidance (via the 10.2.2 technote) does not extend to 9.5.2. For production stability, the only sustainable path is either generating your own certificates with GSKit or migrating the historical environment into PAL.

Microsoft Copilot Analysis: For TM1 9.5.2, there is no official IBM‑issued certificate renewal process anymore. The practical solution is to generate self‑signed certificates using GSKit, but this requires careful alignment of keystore/truststore paths. Long‑term, consolidating historical data into PAL is the recommended approach to avoid repeated SSL outages.

Hello,

One of our customer still running TM1 9.5.2 for history data in parallel to new PAL.

I tried 10.2.2 manual with some modifications to adjust TM1 9.5.2 JRE paths but TM1 still fails to connect to TM1 admin server.  

I'll appreciate any help creating new certs for TM1 9.5.2.

Thank you

Gabi

This SSL certificate expiry issue is a recurring challenge for TM1 10.2.2 environments, especially where upgrading is not feasible due to legacy VBA dependencies. IBM has now published an updated technote specifically to address certificate generation for 10.2.2:

🔗 IBM Support Technote – Updated SSL Certificate Generation for TM1 10.2.2

Key steps outlined in the technote:

·         Download updated scripts provided by IBM for generating new certificates compatible with TM1 10.2.2.

·         Run the certificate utility to create a fresh keystore and truststore.

·         Replace expired certificates in your TM1 installation directories (bin64\ssl and related folders).

·         Restart TM1 services to apply the changes.

This approach ensures you generate valid certificates without relying on shared/public ones, which IBM no longer provides for older versions. The technote also includes troubleshooting notes for common errors during certificate replacement.

👉 Recommendation: Follow the technote step‑by‑step in your PRD environment. If you have multiple servers, repeat the process consistently across all nodes to avoid mismatched trust issues.

Microsoft Copilot Analysis: The new technote is IBM's official path forward for TM1 10.2.2 SSL renewals. Unlike earlier years where IBM distributed public certificates, the current guidance requires generating your own using the provided scripts. This ensures compliance and stability in production environments that cannot upgrade.