Note, this only covers the basic components, so you may have additional work to do after this. Also assumes you are currently using the default certificates, these ones we will create copy those exactly but with another 10 years on the expiry date. I will add that I don't know much about TM1, so probably best not to ask many questions.
Setup CA
Install 64 bit OpenSSL from https://slproweb.com/products/Win32openSSL.html
After install, create folders under root install directory;
demoCA
demoCA\certs
demoCA\crl
demoCA\newcerts
demoCA\private
in demoCA create an empty text file called index.txt
in demoCA create a file called serial (no extension) with content 1000
in command prompt type;
set openssl_conf=c:\openSSL-win64\bin\openssl.cfg
in openssl.cfg make the following edits;
under [ CA_default ]
certs =
c:/openssl-win64/democa/certs #
Where the issued certs are kept
database =
c:/openssl-win64/democa/index.txt #
database index file.
new_certs_dir =
c:/openssl-win64/democa/newcerts #
default place for new certs
certificate =
c:/openssl-win64/democa/private/cacert.pem #
The CA certificate
serial =
c:/openssl-win64/democa/serial #
The current serial number
private_key =
c:/openssl-win64/democa/private/ca.key# The private key
#crlnumber = $dir/crlnumber # the current crl number (must be
commented out for v1 CRL)
private_key =
c:/openssl-win64/democa/private/ca.key# The private key
default_days = 3650 # how long to
certify for
default_crl_days= 3650 #
how long before next CRL
default_md = sha1 # use public key default MD
under [ policy_match ]
change all to optional except CommonName = supplied
under [req ]
default_bits = 1024
default_md = sha1
under [ req_distinguished_name ]
countryName_default =
US
stateOrProvinceName_default =
Massachusetts
0.organizationName_default =
Applix, Inc.
organizationalUnitName =
Applix, Inc
organizationalUnitName_default =
Applix, Inc.
commonName =
supplied
under [ proxy_cert_ext ]
uncomment nsCertType =
server
Important
Note, when generating all certificates/keys use the password applix
Default answers should be correct if you have edited openssl.cfg
correctly, but for the avoidance of doubt;
Country = US
State = Massachusetts
Location = Westboro
Organisation = Applix, Inc.
OU = Applix, Inc.
Create CA key/certs
In command prompt
Cd “c:\openssl-win64\bin”
Openssl genrsa –des3 –out “C:\openssl-win64\democa\private\ca.key” 1024
Openssl req –out “C:\openssl-win64\democa\private\applixca.pem” –new
–x509 –extensions v3_ca –key “C:\openssl-win64\democa\private\ca.key” –days
3650
Openssl ca –gencrl –keyfile “C:\openssl-win64\democa\private\ca.key”
–cert “C:\openssl-win64\democa\private\applixca.pem” –out
“C:\openssl-win64\democa\private\applixcacrl.pem”
Your c:\openssl-win64\democa\private folder should now contain;
Ca.key – private key for CA certificate
applixca.pem – CA certificate
applixcacrl.pem - CRL
Create CSR & private keys
Openssl genrsa –out “C:\openssl-win64\democa\tm1admsvrcert.key” 1024
Openssl genrsa –out “c:\openssl-win64\democa\tm1svrcert.key” 1024
Openssl req –new –sha1 –key “c:\openssl-win64\democa\tm1admsvrcert.key”
–out “c:\openssl-win64\democa\tm1admsvrcert.csr”
Openssl req –new –sha1 –key “c:\openssl-win64\democa\tm1svrcert.key”
–out “c:\openssl-win64\democa\tm1svrcert.csr”
You should now have 4 files in c:\openssl-win64\democa\;
- Tm1admsvrcert.key
- Tm1svrcert.key
- Tm1admsvrcert.csr
- Tm1admsvrcert.csr
Sign certificates
Openssl ca –in “c:\openssl-win64\democa\tm1admsvrcert.csr” –out
“c:\openssl-win64\democa\tm1admsvrcert.pem”
Openssl ca –in “c:\openssl-win64\democa\tm1admsvrcert.csr” –out
“c:\openssl-win64\democa\tm1admsvrcert.pem”
Should end up with 2 more files in c:\openssl-win64\democa\:
- Tm1admsvrcert.pem
- Tm1svrcert.pem
Now open up tm1admsvrcert.pem and tm1admsvrcert.key in notepad, copy
the contents of the key file into the pem file, below the existing content, and
save. Repeat for tm1svrcert.pem. This will give you two pem files that include
the private key.
Generate DER certificate
Openssl x509 –outform der –in
“C:\openssl-win64\democa\private\applixca.pem” –out
“C:\openssl-win64\democa\private\applixca.der”
Generate TM1 files
Now, on your TM1 server create a subfolder under “C:\program
files\cognos\tm1\bin\ssl” called new, copy the below files there;
- Applixca.pem
- Applixca.der
- Applixcacrl.pem
- Tm1admsvrcert.pem
- Tm1svrcert.pem
In command prompt on the TM1 server;
Cd “c:\program files\cognos\tm1\bin”
Tm1crypt –pwd applix –validate
In your “c:\program files\cognos\tm1\bin” folder you should now have
two new files;
- Tm1cipher.dat
- Tm1key.dat
Copy these into C:\program files\cognos\tm1\bin\ssl\new
Create Java keystore
In command prompt;
Cd “C:\program files\cognos\tm1\axajre\jre\bin”
Keytool –import –file “C:\program files\cognos\tm1\bin\ssl\new\applixca.pem”
–keystore “C:\program files\cognos\tm1\bin\ssl\new\tm1store”
Update Certificates
You should now have all the files you need, so follow the below to
update your setup;
Stop your TM1 services
In command prompt;
Cd “C:\program files\cognos\tm1\bin\ssl”
Importsslcert –remove
Create a folder under SSL called “old” to back up your existing files,
move everything except importsslcert.exe, dh512.pem and dh1024.pem into it.
Copy the contents of “new” into the root ssl folder, you should now
have
- Importsslcert.exe
- Applixca.pem
- Applixca.der
- Applixcacrl.pem
- Tm1admsvrcert.pem
- Tm1svrcert.pem
- Tm1cipher.dat
- Tm1key.dat
- Tm1store
- Dh512.pem
- Dh1024.pem
Back in command prompt;
Importsslcert.exe
Start your TM1 services
You should find it’s working, tm1server.log in your data directory
should also confirm this.
And now, the bundle of files to save you the pain;
