Prepare the environment

1. Ensure SSL has been configured for both the Admin and Reporting modules before starting this procedure. For reference, see Configure a CA Certificate for FlexNet Manager for Engineering Applications Admin and Reporting services
2. Create a folder named:
   <Cognos Install Directory>\Flexera\SSL\
3. A backup of several files will be taken during the configuration steps. Follow the instructions below to identify and back them up when prompted.

Configure SSL for Cognos

1. Stop the IBM Cognos service.
2. Export the current Cognos configuration:
   • Run <Cognos Install Directory>\Flexera\fnmea\analytics\bin64\cogstartup.bat as Administrator to start the Cognos Configurator.
   • In the Cognos Configurator, select File > Export As and save the file to <Cognos Install Directory>\Flexera\analytics\configuration\export.xml .
   • Close the Cognos Configurator.
3. Back up the following folders into a zip file named cognos_config_original_keys.zip :
   • <Cognos Install Directory>\Flexera\fnmea\analytics\configuration
   • <Cognos Install Directory>\Flexera\fnmea\analytics\temp
4. Delete these files:
   • <Cognos Install Directory>\Flexera\fnmea\analytics\configuration\cogstartup.xml
   • <Cognos Install Directory>\Flexera\fnmea\analytics\configuration\caSerial
   • <Cognos Install Directory>\Flexera\fnmea\analytics\configuration\certs\CAMCrypto.status
   • <Cognos Install Directory>\Flexera\fnmea\analytics\configuration\certs\CAMKeystore
   • <Cognos Install Directory>\Flexera\fnmea\analytics\configuration\certs\CAMKeystore.lock
   • <Cognos Install Directory>\Flexera\fnmea\analytics\temp\cam\freshness
5. Delete the folder:
   • <Cognos Install Directory>\Flexera\fnmea\analytics\configuration\csk
6. Rename <Cognos Install Directory>\Flexera\fnmea\analytics\configuration\export.xml to cogstartup.xml .
7. Open Command Prompt as Administrator and run:
   

   cd <Cognos Install Directory>\Flexera\fnmea\analytics\bin

   and

   ThirdPartyCertificateTool.bat -c -e -p NoPassWordSet -a RSA -r "<Cognos Install Directory>\Flexera\SSL\cognos.csr" -d "CN={Cognos Server FQDN},OU=IT,O=test,L=test,ST=test,C=com" -H "{Cognos Server FQDN}"

   NOTE : Send cognos.csr to your certificate management team for signing.

8. After receiving the signed certificates, open and save the server certificate with Base-64 encoded X.509:
   • Double-click <Cognos Install Directory>\Flexera\SSL\cognos.cer .
   • In the Details tab, select Copy to File and follow the Certificate Export Wizard prompts to save the root certificate as:
   • Base-64 encoded X.509 (.CER)
   • File Path: <Cognos Install Directory>\Flexera\SSL\cognos.cer
9. Extract and import the root CA certificate:
   • Double-click <Cognos Install Directory>\Flexera\SSL\cognos.cer .
   • In the Certification Path tab, select the root certificate.
   • Click the View Certificate button to open the root certificate.
   • In the Details tab, select Copy to File and follow the Certificate Export Wizard prompts to save the root certificate as:
   • Base-64 encoded X.509 (.CER)
   • File Path: <Cognos Install Directory>\Flexera\SSL\cognos_root.cer
10. Extract the intermediate CA certificate following the same process and save the intermediate certificate as:
    • Double-click <Cognos Install Directory>\Flexera\SSL\cognos.cer .
    • In the Certification Path tab, select the root certificate.
    • Click the View Certificate button to open the intermediate certificate.
    • In the Details tab, select Copy to File and follow the Certificate Export Wizard prompts to save the root certificate as:
    • Base-64 encoded X.509 (.CER)
    • File Path: <Cognos Install Directory>\Flexera\SSL\cognos_intermediate.cer
11. Create the certificate chain file:
    • Copy the contents of <Cognos Install Directory>\Flexera\SSL\cognos_intermediate.cer and <Cognos Install Directory>\Flexera\SSL\cognos_root.cer ( in that order ) into a new Notepad file.
    • Save the contents to a new file called <Cognos Install Directory>\Flexera\SSL\cognos_chain.cer with ANSI encoding.
12. Open a command prompt as an Administrator and run each of the following commands in order to import the certificates into the Cognos Server keystore:
    

    cd <Cognos Install Directory>\Flexera\fnmea\analytics\analytics\bin

    ThirdPartyCertificateTool.bat -i -T -r <Cognos Install Directory>\Flexera\SSL\cognos_root.cer -p NoPassWordSet

    ThirdPartyCertificateTool.bat -i -T -r <Cognos Install Directory>\Flexera\SSL\cognos_intermediate.cer -p NoPassWordSet

    ThirdPartyCertificateTool.bat -i -e -r <Cognos Install Directory>\Flexera\SSL\cognos.cer -<Cognos Install Directory>\flexera\SSL\cognos_chain.cer -p NoPassWordSet

13. Start the Cognos Configurator:
    • <Cognos Install Directory>\Flexera\fnmea\analytics\bin64\cogstartup.bat
14. Modify these settings in the GUI:
    

    Path	Property	Value
    Local Configuration > Environment	Gateway URI	Update URLs to https://
    	External dispatcher URI
    	Internal dispatcher URI
    	Dispatcher URI for external applications
    	Content Manager URIs
    Local Configuration > Security > Cryptography	Common symmetric key store password	NoPassWordSet
    Local Configuration > Security > Cryptography > Cognos	Key store password	NoPassWordSet
    	Use third party CA	True
    	Certificate Authority Password	NoPassWordSet

15. Save the changes.
16. Select Actions > Restart to restart the Cognos service.
17. Close the Cognos Configurator.
18. Import cognos_root.cer into the Admin and Reporting server truststore using:
    

    .\jvm\bin\keytool.exe -keystore ".\jvm\lib\security\cacerts" -storepass "changeit" -import -alias cognos_root -file "<Install Directory>\FLEXnet\certs\cognos_root.cer" -trustcacerts -noprompt

19. In the FNMEA web UI navigate to Admin > System Configuration > Reporting and update the 'Cognos server host' to include https://.

After completing these steps, the FNMEA environment communicates over SSL using a third-party CA-signed certificate.