1. Prepare the environment

1. Open the Cognos Configurator:

E:\Program Files\Flexera\fnmea\analytics\bin64\cogconfigw.exe

2. Stop all Cognos services.

3. Back up the current keystores (Admin keystore and Cognos CAM files) under the Cryptography > Cognos tab.

4. Create an empty directory outside the install directory:

E:\Program Files\Flexera\Cognos\SSL\Certs\

2. Generate new CAM files

1. In Cognos Configurator, go to Cryptography > Cognos.
2. Change the Certificate location to:

E:\Program Files\Flexera\Cognos\SSL\Certs\

NOTE: If renewing certificates, set Use third party CA? to False.

3. Select Save (top-left corner) to generate new CAM files in the folder you created.

3. Import Admin keystore into the Cognos CAMKeystore

Run the following commands from the Admin JVM bin directory:

E:\FLEXnet\manager\admin\jvm\bin\keytool.exe -importkeystore ^

-srckeystore "E:\Program Files\Cognos\SSL\keystore" ^

-alias tomcat -srcstoretype PKCS12 -srcstorepass flexnet ^

-destkeystore "E:\Program Files\Flexera\Cognos\SSL\Certs\CAMKeystore" ^

-deststoretype PKCS12 -deststorepass NoPassWordSet

4. Rename aliases

1. Rename the default 'encryption' alias (“encryption24” used in this example)

E:\FLEXnet\manager\admin\jvm\bin\keytool.exe -changealias ^

-alias encryption -destalias encryption24 ^

-keystore "E:\Program Files\Flexera\Cognos\SSL\Certs\CAMKeystore" ^

-storepass NoPassWordSet -storetype PKCS12

2. Rename 'tomcat' alias to 'encryption'

E:\FLEXnet\manager\admin\jvm\bin\keytool.exe -changealias ^

-alias tomcat -destalias encryption ^

-keystore "E:\Program Files\Flexera\Cognos\SSL\Certs\CAMKeystore" ^

-storepass NoPassWordSet -storetype PKCS12

5. Verify CAMkeystore contents

E:\FLEXnet\manager\admin\jvm\bin\keytool.exe -v -list ^

-keystore "E:\Program Files\Flexera\Cognos\SSL\Certs\CAMKeystore" ^

-storepass NoPassWordSet > CAMKeystore.txt

6. Set the JAVA_HOME variable

Before running any keytool commands, set the JAVA_HOME environment variable to point to the Admin JVM directory:

E:\FLEXnet\manager\admin\jvm\

7. Import root and intermediate certificates

Only perform this step if these certificates have expired in the cacerts keystore.

E:\FLEXnet\manager\admin\jvm\bin\keytool.exe -keystore "E:\Program Files\Flexera\fnmea\analytics\analytics\ibm-jre\jre\lib\security\cacerts" -storepass changeit -import -file "E:\FLEXnet\SSL\ADMIN\admin.cer" -alias admin

E:\FLEXnet\manager\admin\jvm\bin\keytool.exe -keystore "E:\Program Files\Flexera\fnmea\analytics\analytics\ibm-jre\jre\lib\security\cacerts" -storepass changeit -import -file "E:\FLEXnet\SSL\ADMIN\admin_root" -alias root

E:\FLEXnet\manager\admin\jvm\bin\keytool.exe -keystore "E:\Program Files\Flexera\fnmea\analytics\analytics\ibm-jre\jre\lib\security\cacerts" -storepass changeit -import -file "E:\FLEXnet\SSL\ADMIN\admin_intermediate.cer" -alias intermediate

E:\FLEXnet\manager\admin\jvm\bin\keytool.exe -keystore "E:\Program Files\Flexera\fnmea\analytics\analytics\ibm-jre\jre\lib\security\cacerts" -storepass changeit -import -file "E:\FLEXnet\SSL\ADMIN\reporting.cer" -alias report

E:\FLEXnet\manager\admin\jvm\bin\keytool.exe -keystore "E:\Program Files\Flexera\fnmea\analytics\analytics\ibm-jre\jre\lib\security\cacerts" -storepass changeit -import -file "E:\FLEXnet\SSL\ADMIN\reporting_db.cer" -alias db_reporting

E:\FLEXnet\manager\admin\jvm\bin\keytool.exe -keystore "E:\Program Files\Flexera\fnmea\analytics\analytics\ibm-jre\jre\lib\security\cacerts" -storepass changeit -import -file "E:\FLEXnet\SSL\ADMIN\admin_db.cer" -alias db_admin

8. Update Cognos configuration

1. In Cognos Configurator, in Cryptography > Cognos, set Use third party CA? to True.
2. Update Identity name to match your organization’s details.

3. In the Environment tab, update all URLs from http to https. Update DNS if required.

4. Click Save and restart Cognos services using the Cognos Configurator.

9. Update FNMEA Web UI

1. Go to Admin > System Configuration > Reporting.
2. Scroll down and update the Cognos URL to use https.

NOTE: The first connection after updating certificates might take a few minutes. Subsequent logins will work as usual.