Troubleshooting
Problem
When attempting to open a node in TM1 Application Contributor (PMPSVC), the user is presented with a blank page.
Diagnosing The Problem
Have the user right-click the blank page, and select 'View Source'. In this instance, you may find the following error in the source code of the page:
<script language='javascript'>
appId=null;appErrMsg='javax.net.ssl.SSLHandshakeException: com.ibm.jsse2.util.h: PKIX path building failed: java.security.cert.CertPathBuilderException: PKIXCertPathBuilderImpl could not build a valid CertPath.; internal cause is:
java.security.cert.CertPathValidatorException: The certificate issued by CN=IBM Support Root CA, OU=Support, O=IBM, L=Ottawa, ST=Ontario, C=CA is not trusted; internal cause is:
java.security.cert.CertPathValidatorException: Certificate chaining error';
</script>
<script language='javascript'>
appId=null;appErrMsg='javax.net.ssl.SSLHandshakeException: com.ibm.jsse2.util.h: PKIX path building failed: java.security.cert.CertPathBuilderException: PKIXCertPathBuilderImpl could not build a valid CertPath.; internal cause is:
java.security.cert.CertPathValidatorException: The certificate issued by CN=IBM Support Root CA, OU=Support, O=IBM, L=Ottawa, ST=Ontario, C=CA is not trusted; internal cause is:
java.security.cert.CertPathValidatorException: Certificate chaining error';
</script>
Resolving The Problem
The certificate chaining error on the page had been caused by the fact that there is another webserver/balancer that sits in front of the TM1 Web / TM1 Application URLs. And that the webserver/balancer is secured using SSL.
For this type of configuration to work, you must trust the Root and Intermediate Certificate Authority of the webserver/balancer with your TM1 Configuration. To trust the Certificate Authorities, import the certificates in to the appropriate keystore:
Import in to TM1Store keystore:
-Open Command Prompt, and navigate to <installdir>\tm1_64\jre\bin\
-Type: keytool -import -trustcacerts -file "C:\Test\ca-chain.cert.pem" -keystore "C:\Program Files\ibm\cognos\tm1_64\bin64\ssl\tm1store" -alias certchain -storepass applix
Import in to TM1Store keystore:
-Open Command Prompt, and navigate to <installdir>\tm1_64\jre\bin\
-Type: keytool -import -trustcacerts -file "C:\Test\ca-chain.cert.pem" -keystore "C:\Program Files\ibm\cognos\tm1_64\bin64\ssl\tm1store" -alias certchain -storepass applix
*-file "C:\Test\ca-chain.cert.pem" <--Update to reflect the location of your Root and Intermediate certificates, in this example both certificates have been added to a single file
*-keystore "C:\Program Files\ibm\cognos\tm1_64\bin64\ssl\tm1store" <--Update the path to the tm1store file for your install directory
*-keystore "C:\Program Files\ibm\cognos\tm1_64\bin64\ssl\tm1store" <--Update the path to the tm1store file for your install directory
*-alias certchain <--Provide a relevant alias for your certificate
Document Location
Worldwide
[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSD29G","label":"IBM Planning Analytics"},"Component":"","Platform":[{"code":"PF033","label":"Windows"}],"Version":"All Versions","Edition":"","Line of Business":{"code":"LOB10","label":"Data and AI"}}]
Was this topic helpful?
Document Information
Modified date:
22 April 2019
UID
ibm10882082