PH57549: COGNOS ANALYTICS DOCUMENTATION DOES NOT SPECIFY THE REQUIREMENTS FOR CERTIFICATES TO MEET OUR CRYPTOGRAPHIC CONFORMANCE.

APAR status

• Closed as documentation error.

Error description

• Cognos Analytics documentation does not specify the requirements
  for certificates to meet our Cryptographic Conformance
  requirements
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * CA users                                                     *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * In the Cognos Analytics 12.0.x (and 11.2.x) documentation,   *
  * in the sections about implementing Third-Party Certificate   *
  * Authority, no guidance is provided about the minimum         *
  * requirements for certificates (in particular, key length and *
  * signature algorithm), in order that they will work           *
  * successfully with the product.                               *
  *                                                              *
  * For example, if the environment is set to NIST SP800-131A    *
  * conformance, the certificates need a minimum of:             *
  *                                                              *
  * a) SHA-256 RSA signature (SHA-1 will break the product,      *
  * causing a restart loop every 10 minutes)                     *
  * b) 2048-bit key length (1024 bit will, as above, break the   *
  * product, causing a restart loop)                             *
  *                                                              *
  * Whereas, with Cognos conformance, you can use certificates   *
  * with a minimum of:                                           *
  *                                                              *
  * a) SHA1 RSA signature                                        *
  * b) 1024 bit key length                                       *
  *                                                              *
  * Having the certificate requirements clearly stated would     *
  * prompt customers to provide that detail to their Certificate *
  * Authority when having certificates signed, or to check that  *
  * their inhouse CAs can provide appropriate certificates       *
  * before encountering issues during their implementation.      *
  *                                                              *
  * With having 3 Crypto conformance choices in 12.0.x, clearly  *
  * stating the requirements would deflect a number of cases.    *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  

Problem conclusion

• . The topic is updated for 11.2.x and 12.0.x:
  *
  https://www.ibm.com/docs/en/cognos-analytics/11.2.0?topic=option
  s-external-certificate-management-in-cognos-analytics
  *
  https://www.ibm.com/docs/en/cognos-analytics/12.0.0?topic=option
  s-external-certificate-management-in-cognos-analytics
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

Applicable component levels