TM1 & Cognos Analytics SSL Issue with CAM Security

[mce]

Hello,

I am trying to enable SSL for both Cognos Analytics (11.0.13) and Planning Analytics (2.0.x).
I succeeded for enabling SSL for both. Cognos Analytics works with custom SSL by itself with no issues. Planning Analytics works ok by itself with SSL with no issues.

I implemented all the steps in
https://www.ibm.com/docs/en/cognos-anal ... -authority
https://www.ibm.com/docs/en/planning-an ... rtificates
https://www.ibm.com/support/pages/node/885448
https://www.ibm.com/support/pages/how-c ... dispatcher.


But when I use CAM security to login to TM1 via Cognos Analytics, then I get an error in both Architect and TM1Web.

Error in TM1Web that appears after successful authentication.

Tm1WebError.png (4.04 KiB) Viewed 2700 times

Error in Architect that appears after successful authentication.

ArchitectError.png (6.94 KiB) Viewed 2700 times

Is there anyone else who faced this issue before? I would appreciate any responses.

Regards,

[burnstripe]

I'm assuming TM1 config has been updated to reference cognos analytics with https in the address.

Do you have Planning Analytics and Cognos Analytics installed on different servers? Are you using a certificate from a CA authority or a self-certified certificate.

It could be that the Planning Analytics server doesn't trust the CA certificate, can happen if you're using a self certified certificate. Do a search for "manage computer certificates" from there you can import the cognos analytics certificate into the trusted root section.

If you're still unsure of the cause try using a tool like fiddler which can trace network traffic and try accessing the website through a browser.

Also if planning analytics has just been updated to ssl don't forget to update the bi_interop files that are put in the Cognos Analytics gateway so they are also pointing to planning analytics under https as opposed to http

[mce]

I'm assuming TM1 config has been updated to reference cognos analytics with https in the address.

Yes, I have done this.

Do you have Planning Analytics and Cognos Analytics installed on different servers? Are you using a certificate from a CA authority or a self-certified certificate.

They are on the same server. Using a custom certificate certified from CA authority.

It could be that the Planning Analytics server doesn't trust the CA certificate, can happen if you're using a self certified certificate. Do a search for "manage computer certificates" from there you can import the cognos analytics certificate into the trusted root section.

I already imported Cognos Analytics certificate into trusted root for PA.

Also if planning analytics has just been updated to ssl don't forget to update the bi_interop files that are put in the Cognos Analytics gateway so they are also pointing to planning analytics under https as opposed to http

I already updated bi_interop files under Cognos Analytics installation by adding the new https addresses of PA.

[burnstripe]

What's the ServerCAMURI and ClientCAMURI in the config. When copying the bi_interop files what folders did you pop them into on the bi gateway?

When I said this
"It could be that the Planning Analytics server doesn't trust the CA certificate, can happen if you're using a self certified certificate. Do a search for "manage computer certificates" from there you can import the cognos analytics certificate into the trusted root section"

I wasn't talking about the java key stores. I mean is the certificate trusted by the server and is the authority used to certify the certificate trusted by the server?

It sounds like to help much more we'd need to look at the network events going on so we can see at what stage the URL redirects are halted. (fiddler will show you this)

[burnstripe]

Also make sure the Clientcamuri is pointing to your cognos analytics gateway and not the dispatcher. Noticed an error in one of those IBM links you shared