Product:
Planning Analytics 2.0.6
TM1SERVER_APP_version=TM1SERVER_APP-AW64-ML-RTM-11.0.6.71-0
Microsoft Windows 2016 server

Problem:
How check the SSL certificate in TM1WEB keystore?

Solution:
On the PA tm1WEB servern, start ikeyman.exe as administrator, from folder C:\Program Files\ibm\cognos\tm1web\jre\bin.
Click on open icon.

Open C:\Program Files\ibm\cognos\tm1_64\configuration\certs\CAMkeystore file.
Click OK and enter password: NoPassWordSet
Double click on the line encryption under Personal Certificates.

Here you can see when the server certificate expires. Click OK to close the dialog.
Select Signer Certificates in the Key database content drop-down list.
Find you company root certificate in the list, name can be anything you named it at setup.

When your find your company’s certificate, double click to see how long it is valid.
You can here use the ADD button to add new certificates if needed.

Important that the personal certificate is named encryption.

You can turn the use of SSL on and off with settings in Cognos Configuration. See more at this link:

https://www.ibm.com/support/pages/use-ikeyman-configure-custom-ssl-certificates-tm1web

More information:

Planning Analytics 2.0.9.2 and newer version have a different key-store for TM1WEB certificates.

IBM Planning Analytics: New Features

https://www.ibm.com/support/pages/node/291221
https://www.tm1forum.com/viewtopic.php?t=15433

https://docs.microsoft.com/en-us/sysinternals/downloads/procmon