Philippe,
If you want to stick with the out-of-the-box IBM SSL rather than pursue the custom certificate route, this should help. I think we are already all set with the default certificates.
You really have to look at https://www.ibm.com/docs/en/planning-analytics/2.1.0?topic=security-default-configuration for a better sense of what certificates are in force for a fresh install, such as what you have to do when you install PA 2.0.9.21, and 2.1.8/2.1.9. Previously, the upgrade upon upgrade upon upgrade with preserved files in-between that were tweaked several versions/years ago will need some untangling. But the latest release require a fresh install, so the following will be true.
\bin64\ssl\ibmtm1.arm is the default certificate and it does not expire until 2035. ibmtm1.arm has been in use for a few years now, and even in 2020, its expiration was 2035. The "applixca" files in that folder are just there for some historical/nostalgic reason in my opinion, but I'm always focused on the latest releases, so there is that.
Inside of the \bin64\ssl\ibmtm1.kdb keystore, ibmtm1.arm has already been imported as "ibmtm1_server" and has been set as the default personal certificate. The "keystore" is what the components of PA will use to access the stored certificates and ibmtm1.sth is an encrypted password that PA uses to have access into the ibmtm1.kdb keystore while it is running.
New file \bin64\config.tm1admsrv.json replaces the Cognos Configuration node that accepted TM1 Admin server settings. It defaults to using the \bin64\ssl\ibmtm1.kdb keystore and referring to the server certificate label ibmtm1_server that represents the imported ibmtm1.arm certificate IBM provided. A fresh install should be all set using ibmtm1.arm inside of ibmtm1.kdb.
You may have a \bin\tm1api.config or \bin64\tm1api.config where Architect and Perspectives have been installed on the users machines. This text file just refers to where Architect/Perspectives can find the keystore if it has been moved from \bin64\ssl\ibmtm1.kdb, if it is at a networked shared location, or it has been renamed. You likely don't have this tm1api.config file if you never used custom certificates, but I mentioned it just in case. See link but ignore the stale top half. Most of the old Architect and Perspectives SSL Options are deprecated, so the top half is stale.
If you want to see the inside of the \bin64\ssl\ibmtm1.arm cert yourself, make a copy of it, and rename the copy to ibmtm1.crt. Then right-click on it and select "Open"...not "Install". Microsoft will show you the date, etc. 2035.
Custom certificates for PA are not impossible, just really, really tedious.....Really tedious.
NEW for 2.0.9.21/2.1.8/2.1.9 default \bin64\config.tm1admsrv.json file:
{
"tm1AdminNonSSLPortNumber": 5495,
"tm1AdminSSLPortNumber": 5498,
"tm1AdminHTTPPortNumber": 5895,
"tm1AdminHTTPSPortNumber": 5898,
"tm1AdminSupportNonSSLClients": false,
"tm1AdminKeyFile": "./ssl/ibmtm1.kdb",
"tm1AdminKeyStashFile": "./ssl/ibmtm1.sth",
"tm1AdminKeyLabel": "ibmtm1_server",
"tm1AdminTLSCipherList": [],
"tm1AdminFIPSOperationMode": 2,
"tm1AdminSupportPreTLSv12Clients": false,
"tm1AdminNIST_SP800_131A_MODE": false,
"tm1AdminIPVersion": "IPv4",
"tm1AdminActivityInterval": 10,
"tm1AdminInactivityTimeout": 10,
"tm1AdminRESTAPIToken": ""
}
The pre-2.0.9.21/2.1.8/2.1.9 Cognos Configuration. The old default NIST setting has been changed in the new release for some reason.
From the online documentation:
- applixca.der
- The original default certificate in DER format used for Java™ certificate stores.
- applixca.pem
- The original root authority certificate.
- ibmtm1.arm
- The default certificate file.
- ibmtm1.crl
- The certificate revocation list.
- ibmtm1.kdb
- The key database file, which contains the server certificate and trusted certificate authorities.
- ibmtm1.rdb
- The requested key pair and the certificate request data.
- ibmtm1.sth
- The key store, which contains passwords to the key database file.
- tm1ca_v2.der
- The updated default certificate.
- tm1ca_v2.pem
- The updated default root authority certificate.
- tm1store
- The Java certificate store containing the public root authority certificate.