Planning Analytics 2.x

Microsoft Windows 2016 Server

User have removed some sheet in a excel workbook and publish it again to TM1WEB.

But can now not open the application view in TM1WEB. User gets a error “Failed to open the target workbook. Make sure that the file has not been renamed or deleted”.

Check the excel workbook for reference errors.
If there are formulas that referee to the deleted sheet, this can give this error.

Ensure that all formulas point to existing columns and sheets in the workbook.

Also ensure you do not have inserted unsupported object into the workbook, like word documents and links to pictures that may not work in TM1WEB.

Redo the workbook, and publish it again.

Also ensure you do not have empty columns on the right side in your spreadsheet, that can also affect TM1Web performance.

More Information:


Planning Analytics Workspace
Microsoft Windows 2016 server

PAW does not respond and most users do not get reports shown.

On the TM1WEB server you find this in log file D:\Program\ibm\cognos\tm1_64\webapps\tm1web\WEB-INF\logs\message.log


Caused by: java.lang.OutOfMemoryError: Java heap space



Go to Cognos Configuration for TM1

Go to Environment – IBM Cognos TM1 – Maximum memory for WebSphere liberty

And increase value to 8192.
Right click and restart IBM Cognos TM1 service.

Check in task manager that you still have free RAM memory on your server.

Check if the websheet and reports now work in TM1WEB or PAW.

More information:

Planning Analytics Workspace 53
Microsoft Windows 2016 server

Blank report in paw or not loading.


Error message in error.log file under pa-gateway folder

A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond……. AH00898: Error reading from remote server returned by /tm1web/dwr/engine.js, referer: ….

Suggested Solution:

On your Windows 2016 server where PAW is installed.
Go to the config folder e.g. d:\ibm\paw\config and update the file paw.ps1 in notepad++

add last to file


Save the file.

Restart the Planning Analytics Workspace.

Open a Powershell window (with “Run as Administrator”) on the machine you have installed PAW
change into the installation directory of your PAW installation
move into the “scripts” folder: cd scripts
– to stop PAW execute the command: ./paw.ps1 stop
– to start PAW execute the command: ./paw.ps1 start


Some views of PAW is dependent on settings in TM1WEB, so you can also update the webapps\tm1web\WEB-INF\configuration\tm1web_config.xml file to get it to work.

add values like

<add key=”WorkbookMaxCellCount” value=”500000” />

More information:

For linux

Planning Analytics
Microsoft Windows 2016 server

Changes is made to tm1web_config.xml file to pre-populate the HOST name field, so the user do not need to select adminhost before getting a list of applications. But the change is not visible when you browse to

The configuration parameters for IBM® Planning Analytics TM1® Web are stored in the tm1web_config.xml file.

The tm1web_config.xml file is located in the following location:

<TM1 install location>\webapps\tm1web\WEB-INF\configuration\

You can edit the file to add several adminhostservers, separated by semicolon.

 <!-- If set, users will not be asked to enter Admin Host during login. -->
<add key="AdminHostName" value=";;" />



You must close the notepad program that you use to edit the tm1web_config.xml, before the TM1 Web service will be able to read the file and use the changes.

You do not need to restart the service “IBM Planning Analytics Spreadsheet Services” for the changes to take affect.

To troubleshoot; check the log file tm1web.log in folder D:\Program Files\ibm\cognos\tm1web\webapps\tm1web\WEB-INF\logs.  You may have this error in it;


Exception Error: ‘d:\Program Files\ibm\cognos\tm1web\webapps\tm1web\WEB-INF\configuration\tm1web_config.xml (The process cannot access the file because it is being used by another process.)’

WHILE [CCLMsg: system text=’loading TM1Web configuration from file ‘d:\Program Files\ibm\cognos\tm1web\webapps\tm1web\WEB-INF\configuration\tm1web_config.xml”]

Stack Trace: com.cognos.ccl4j.exceptions.CCLRuntimeException (root

‘d:\Program Files\ibm\cognos\tm1web\webapps\tm1web\WEB-INF\configuration\tm1web_config.xml (The process cannot access the file because it is being used by another process.)’

WHILE [CCLMsg: system text=’loading TM1Web configuration from file ‘d:\Program Files\ibm\cognos\tm1web\webapps\tm1web\WEB-INF\configuration\tm1web_config.xml”]










Caused by: d:\Program Files\ibm\cognos\tm1web\webapps\tm1web\WEB-INF\configuration\tm1web_config.xml (The process cannot access the file because it is being used by another process.)

at Method)





More information:

Please check carefully if the instructions are valid for the new TM1WEB, that use different path.

AdminHostName If set, users are not asked to enter a value for Admin Host during login.

Other values you can change for tm1web:

<!-- CubeViewerRowPageSize: Number of rows to fetch in a page of cubeviewer -->
<add key="CubeViewerRowPageSize" value="500" />
<!-- CubeViewerColumnPageSize: Number of columns to fetch in a page of cubeviewer -->
<add key="CubeViewerColumnPageSize" value="100" />

<!-- MaximumSheetsForExport: Maximum number of sheets allowed to Export -->
<add key="MaximumSheetsForExport" value="80" />

Planning Analytics

Microsoft Windows 2016 server

New setup of PA with SSO to CA11 (Cognos Analytics), when login to TM1 Architect, you get a blank screen,

and you have “Internet Explorer Enhanced Security Configuration is enabled”.


You must on each computer for each user that run Tm1 Architect (or try to reach TM1WEB) add the CA11 server to local intranet in internet options.

On the computer go to Internet Options ( in control panel or from settings in your browser)

Select security tab.

Select local intranet and click on sites.

Enter the url to the CA11 server and click ADD.  (like

Click Close.

Click OK.

Best is to add all your Cognos servers to the local zone.

Planning Analytics Workspace 68
Microsoft Windows 2016 server

When from IE browse to PAW portal to login, you get redirected to Cognos Analytics, but are then stuck.

Suggested Solution:

Use Chrome instead.

Internet Explorer 11 is no longer supported with Planning Analytics Workspace 2.0.57 and higher versions of Planning Analytics Workspace.

More information:

Planning Analytics Workspace 68
Microsoft Windows 2016 server

Start of Docker service give error like:

error during connect: Get http://%2F%2F.%2Fpipe%2Fdocker_engine/v1.40/containers/json: open //./pipe/docker_engine: The system cannot find the file specified. In the default daemon configuration on Windows, the docker client must be run elevated to connect. This error may also indicate that the docker daemon is not running.

Suggested solution:

Check the file C:\ProgramData\docker\config\daemon.json for typographical errors.
If you change the file daemon.json, you must reboot the windows server for the changes to take affect.

Rename the file d:\ibm\paw\config\paw.ps1 to paw.ps1.txt and try to start PAW again.

To get info about docker enter

docker info

To remove docker, start PowerShell as administrator, and try this commands:

./paw.ps1 down
docker kill $(docker ps -q)
docker rm $(docker ps -a -q)
docker rmi $(docker images -q)

docker ps --quiet | ForEach-Object {docker stop $_}
docker system prune --volumes --all

If for some reason, the docker command does not work at all. The Docker service does not start. You can try create a new docker folder like d:\dock and then change the C:\ProgramData\docker\config\daemon.json file to point to the new folder. “data-root”: “d:\\dock” tells what folder to use.

Reboot the windows server and wait 30 min to see if the windows docker service starts.

Remove HostValidated file from your folder d:\ibm\paw\config

Remove upgradewarned file from your folder d:\ibm\paw\config

If its starts, you can restart the installation of PAW, by go to your d:\ibm\paw folder and run the ./Start.ps1 command inside PowerShell again.

If you see error in windows event log like this:

Syscall did not complete within operation timeout. This may indicate a platform issue. If it appears to be making no forward progress, obtain the stacks and see if there is a syscall stuck in the platform API for a significant length of time…

cleanup: failed to delete container from containerd: no such container…

driver “windowsfilter” failed to remove root filesystem: hcsshim::GetComputeSystems: The requested compute system operation is not valid in the current state.

and you are using Symantec Endpoint Protection version 14.3.3385.1000 then you should uninstall Symantec software fully from the server.

Then install PAW without the anti-virus software.

When PAW and Docker is installed and working, then you can install your Anti-virus software again.  You may need to configure the Anti-virus software so it works with Docker.

More information:

scripts/paw.ps1 down –rmi all -v

Planning Analytics   TM1_version=TM1-AW64-ML-RTM-11.0.910.5-0
Microsoft Windows 2016 server


How upgrade Planning Analytics to later version?

Suggested solution:
Always follow IBM instructions first, this is a suggestion on what to check for at a installation of TM1.

In the new versions of PA, you can stop the IBM services, and do the installation on top of the existing Planning Analytics folder. This is the recommended way for a upgrade.

Download the latest version from IBM:

For a installation on a Windows server, you need the files that are for windows;

and the latest PAW and PASS…

Check this before installation on your new windows server:

Install Microsoft Visual C++ 2010 SP1 Redistributable Package

Install SQL 2012 native client for ODBC support to SQL databases

Install NET Framework 4.8

Turn DEP off in Windows control panel
Set Power Options to HIGH Performance in Windows control panel
Turn off IEESC (internet explorer enhanced security configuration)
Start Print spooler service (on the TM1 server)
Exclude cognos and docker folders from anti-virus software scanning
Open firewall ports 80,443,9510,9511 to TM1 end users
Open firewall ports 80,443,9012,9510,9511, 5495,5498,5895,5898, 12300-12400 between servers.
Open firewall ports 9300 for Cognos BI, 1433 for SQL, 25 for Mail, 389 for Active Directory.
Install 7zip and Notepad++ to edit xml files on the server.


Setup Planning Analytics local:

If more than one network card, then set the order of there use from powershell command;


Set-NetIPInterface -InterfaceIndex 2 -InterfaceMetric 50
Unzip tm1_winx64h_2.0.910.5_ml.tar.gz and Install with issetup.exe
Set maximum memory in MB for WebSphere to 8192 in Cognos Configuration
Check file C:\Program Files\ibm\cognos\analytics\templates\ps\portal\variables_tm1.xml exist on your CA11 server. Rename the variables_tm1.xml.sample file to variables_tm1.xml
Update files planning.html, tm1web.html with tm1web servername and port on CA11 server

// Update the following to point to the location of the planning service(s)
var planningServices = ["",""];

Update file pmhub.html with PAW servername and port on CA11 server

// Update the following to point to the location of the pmhub service(s)
var pmhubURLs = [","",""];
Set your servers ip, in the tm1s.cfg file to IPAddressV4=”″  (replace with your ip value)
Update a planning application for use of SSO and CAM in tm1s.cfg with below values;





Surf to to connect it with a CAM application
To preset the admin host in tm1web, Open D:\Program Files\ibm\cognos\tm1web\webapps\tm1web\WEB-INF\configuration\tm1web_config.xml and change <add key=”AdminHostName” value=”paservername” />

Open D:\Program Files\ibm\cognos\tm1web\webapps\tm1web\WEB-INF\configuration\tm1web_config.xml and change the timeout for the web
<add key=”HttpSessionTimeout” value=”60″ />
Open firewall ports 80,443,9510,9511,8888, 5495,5498,5895,5898,9012 and 12345.. for developers.
CertificateVersion=2 in TM1S.CFG gives that you use 2048-bit encryption internal in TM1
Test to remove any MTQ line in TM1S.CFG for new versions of Planning Analytics
For a new installation create a folder structure for the applications, like d:\tm1\app\datafiles…
Add the PortNumber=12345 (and below numbers) to the tm1s.cfg file for your applications.

HTTPportnumber=12346  (they must be unique for each TM1 application)


Change log time to LOCAL timezone, by in the file edit:

Where TM1 architect is installed, open C:\ProgramData\Applix\TM1\tm1p.ini and add lines

AllowImportCAMClients = T 

CognosGatewayURI =

Language=ENG in TM1P.INI will give English menu in TM1 Architect


Setup new TM1WEB: IBM Planning Analytics Spreadsheet Services

Install tm1web (PASS) from tm1web-11.0.68-21100620-winx64h_bundle folder by click on exe file

Change to port 9511, in file server.xml, located in the folder C:\Program Files\ibm\cognos\tm1web\wlp\usr\servers\tm1web

Restart the “IBM Planning Analytics Spreadsheet Services”.

To make TM1 APP WEB work, you need to update file pmpsvc_config.xml in folder D:\Program Files\ibm\cognos\tm1_64\webapps\pmpsvc\WEB-INF\configuration with value:

<client id="thinClient" type="html-new" uri="">

Start “IBM Cognos TM1” service, that is for Tm1 App Web (pmpsvc).

Setup Planning Analytics Workspace on Windows 2016

To install to d drive, create c:\programdata\docker\config\daemon.json with this content:

"debug": true,
"data-root": "d:\\docker"
Run ./Start.ps1

If you have issue, use this powershell commands to get more information:

PS C:\> docker version
PS C:\> docker image ls
PS C:\> docker ps --all

PS C:\> Get-VMSwitch
PS C:\> Get-NetNat
PS C:\> Get-ContainerNetwork
Update PAW administration for CAM
IBM cognos BI gateway URI

IBM cognos BI Dispatcher URI

Change $env:CAMLoginNamespace to same as Namespace ID in Cognos Configuration.

Set timeout to $env:ProxyTimeoutSeconds=900 in file paw.ps1
To get the internal gateway IP for use on windows 2016 server enter:

docker inspect pa-gateway -f' {{.NetworkSettings.Networks.nat.IPAddress}}'
Locate the scripts/shutdown.ps1 script in your Planning Analytics Workspace installation folder.

Copy the scripts/shutdown.ps1 script to a permanent location on your system (d:\ibm\).

In a command window, open the Group Policy Editor (GPE) by running gpedit.msc.

Expand Computer Configuration and select Windows Settings.

Double-click Scripts (Startup/Shutdown).

Switch to the PowerShell Scripts tab.

Click Add and add the shutdown.ps1 script from the folder.

If you need to change port for paw set $env:PAGatewayHTTPPort=”8080” in file paw.ps1
Install the PA agent for the new workspace version on your TM1 server

Setup mail for the PA agent


How to upgrade PAW:
Download the new version and unzip the file in a new folder e.g. \ibm\paw69

  1. Stop the running paw with command ./scripts/paw.ps1 stop
  2. Copy the /ibm/paw68/config/paw.ps1 file from your current installation to the new installation location (/ibm/paw69/config).
  3. Copy the /ibm/paw68/config/certs directory from your current installation to the new installation location.
  4. Optional: If you configured SSL, copy the /ibm/paw68/config/ssl directory from your current installation to the new installation location.
  5. Install Planning Analytics Workspace Local in the new installation location. See Installing Planning Analytics Workspace Local. Go to the /ibm/paw69/ folder and run ./Start.ps1

    Reply “y” when you are prompted to install the Docker images. Reply “y” when you are prompted to open the administration tool.


More Information:

How to Upgrade Planning Analytics Workspace (PAW)

Older versions are listed here:

Planning Analytics Workspace

PAA Agent Version
Microsoft Windows 2019 server

This request cannot be understood by the server. This might be because there is a problem with the syntax. Retry this action.

Above error when you in PAW click on Administration – Databases – Planning Sample – Configuration.

The user who login to PAW need to be local Admin inside the TM1 instance, to be able to see and change the configuration (tm1s.cfg) from the PAW administration page.

Go into Tm1 Architect, open the TM1 instance, right click and select security – Clients/Groups:
Find your username, and mark that you are ADMIN.
Click OK.

The user can restart the TM1 instance from PAW, without being ADMIN inside the TM1 application.

More information:


Planning Analytics 2.0.9 TM1_version=TM1-AW64-ML-RTM-
Cognos Analytics 11.1.7 Product_version=11.1 R7 (LTS)

Microsoft Windows 2019 server with CA11 and PA
Red Hat Linux with PAW

How add SSL certificates to the Cognos servers?

Use the official documentation in the first place, this is only a suggestion.
This instruction may not cover all the steps you need to do.

The TM1 certificate need to be added to the CA11 keystore once, to be able to run reports on TM1 data.

Go to <Cognos Analytics installation>\jre\bin and execute ikeyman.exe as administrator

Select Open a key database file, and navigate to the cacerts keystore located in <Cognos Analytics installation>\jre\lib\security. As type select JKS.

On prompt enter password changeit

In the drop down, switch from Personal Certificates to Signer Certificates

On the right select Add

Browse for the certificate file ibmtm1.arm located in <Planning Analytics Install>\bin64\ssl.
On prompt enter an alias for the certificate in the keystore, exempli gratia: TM1Server.
Click OK
Exit ikeyman.

Suggested Solution:

Backup configuration and ssl and security folders before you do any changes.

Go to Internet Information Service Manager.
Select the server and click on Server Certificates icon.
Click Create Certificate Request.
Fill in the Distinguished Name properties, important that COMMON NAME is the servername.
Select “Microsoft RSA SChannel Cryptographic Provider” and Bit Length: 2048
Save the result in a request.txt file.
Send this request to your Certificate Authority, or if you use Microsoft CA, go to the website and click Certificate Request link. Mostly named “Request a certificate”.
Select Submit a certificate request by using a base-64-encoded CMC or PKCS #10 file, or submit a renewal request by using a base-64-encoded PKCS #7 file.
Copy the text from you request.txt file and paste it into the Saved Request field.
Select “Web Server” in the Certificate Template dropdown.
Enter the DNS servername in Additional attributes, like
Click Submit.
Requesting for certificate in Windows 2012 – Deep Security (

In the Certificate Issued dialog you select Base 64 encoded.
Download the certificate  (certnew.cer) and the certificate chain.
In IIS manager go to “complete certificate request”
Select the cer file you got.
Enter the Friendly name to your servername:
Leave certificate store to be personal and click OK.

If this is a new server, you need to import the root and issuing certificates to the Trusted Root Certification Authorities tab inside Certificate Manager. To access Certificate Manager, click the Start button, type certmgr.msc in the search field, and click the Enter key. More info in link;

Go to IIS Manager, select “Default Web site” and click on Bindings.
Click Add.
Select Type HTTPS and select your server certificate.

Click OK.
Remove the HTTP binding and any old HTTPS certificates.
Click Close.

Inside Cognos Configuration change Gateway URI to point to
Inside TM1S.CFG file change ClientCAMURI to be the same (

Inside C:\ProgramData\Applix\TM1\tm1p.ini you may need to update; CognosGatewayURI =

You may need to export a pfx file with the key value from inside Certificate Manager on your windows server, right click on servername in Server Certificate and select export.

Stop the cognos service.
Inside Cognos Configuration, change to HTTPS on all points under environment tab.
Click on save in Cognos Configuration, this will create the new cert and place it in CA keystore.
Open a command prompt as administrator.
Go to folder d:\Program Files\ibm\cognos\analytics\bin and enter below command, to export the cert:

ThirdPartyCertificateTool.bat -E -T -p NoPassWordSet -r ca.cer

Go to certmgr.msc, go to Trusted Root Certification Authorities tab, right click to import the ca.cer certificate.

If you not already have done so, you need to export the root and indeterminate certificates from your IIS Cognos website. Open a web browser, and on the certificate click – view and then export for each cert.

IIS 10 Exporting/Importing SSL Certificates |
Rename the certificate files to not have space in there names.
Copy the certificate files to your Cognos server folder d:\Program Files\ibm\cognos\analytics\bin
Open a command prompt as administrator and go to folder C:\Program Files\ibm\cognos\analytics\bin
Enter command to import (the order of import is crucial)
ThirdPartyCertificateTool.bat -i -T -r Root.cer -p NoPassWordSet
ThirdPartyCertificateTool.bat -i -T -r Issuing.cer -p NoPassWordSet
ThirdPartyCertificateTool.bat -i -T -r Servername.cer -p NoPassWordSet

Start Cognos BI.

Go to IIS Manager, select \ibmcognos\bi folder.
Click on URL Rewrite.
Click on Reverse Proxy rule.
Edit the rule to use HTTPS instead of HTTP.{R:0}
Click apply in top right corner.
Exit IIS manager.


Stop TM1 services.

Change TM1S.CFG to have;


Copy your ca.cer file to the Planning Analytics folder d:\Program Files\ibm\cognos\tm1_64\bin64\ssl;

Open a command prompt as administrator and go to folder C:\Program Files\ibm\cognos\tm1_64\bin64

Import to Tm1 admin server with command:

gsk8capicmd_64 -cert -add -db “d:\Program Files\ibm\cognos\tm1_64\bin64\ssl\ibmtm1.kdb” -stashed -label caRoot -file “d:\Program Files\ibm\cognos\tm1_64\bin64\ssl\ca.cer” -format ascii -trust enable

Open a command prompt as administrator and go to folder C:\Program Files\ibm\cognos\tm1_64\jre\bin

Import to Tm1 App Web (PMPSVC) server with command:
keytool.exe -import -trustcacerts -file “d:\Program Files\ibm\cognos\tm1_64\bin64\ssl\ca.cer” -keystore “d:\Program Files\ibm\cognos\tm1_64\bin64\ssl\tm1store” -alias caRoot -storepass applix

Change the file D:\Program Files\ibm\cognos\tm1_64\webapps\pmpsvc\WEB-INF\configuration\fpmsvc_config.xml to have https at 3 places:

<external uri=”″/>

<gateway uri=””/>

<dispatcher uri=””/>

Save the file.

Go to d:\program files\ibm\cognos\tm1_64\jre\bin and execute ikeyman.exe as administrator.
Open D:\Program Files\ibm\cognos\tm1_64\configuration\certs\CAMkeystore file as PKC$12 type.
Enter password NoPassWordSet.
Rename encryption to encryptionold.
Click Export/import button:
Mark Import Key.
Select your server pfx file and click OK.
Enter the password you got at the export of the pfx file.
Change label to encryption and click apply.

Switch to Signer Certificates.
Click Add.
Select your root.cer file from the file system and click OK.
Enter a name e.g. rootcert
Repeat for any intermediate certificates
Click Add.
Select your issuing.cer file from the file system and click OK.
Enter a name e.g. issuingcert

Click Add.
Select  D:\Program Files\ibm\cognos\tm1_64\bin64\ssl\ibmtm1.arm file.
On prompt enter an alias for the certificate in the keystore, e.g. TM1Server.

Exit ikeyman program.
Use IKeyMan to Configure Custom SSL Certificates for TM1Web (

Open Cognos Configuration for TM1 (planning analytics).
Add the StandaloneCertificateAuthority property under the Local Configuration > Advanced Properties
section and set it to True.

Under Environment change Gateway URI to
and Content Manger URI to

Under TM1 Applications change TM1 Application Server gateway URI to
and change External server URI to
and change TM1 Application Server Dispatcher URI to

Under Security > Cryptography > Cognos set Use third party CA? to True.

Save and start TM1 services.

If this is a new installation, you need to update the d:\Program Files\ibm\cognos\analytics\webcontent\bi\planning.html and d:\Program Files\ibm\cognos\analytics\webcontent\bi\tm1\web\tm1web.html files with HTTPS.


Copy your previous created pfx file (that contain the hole chain of certificates) to folder d:\Program Files\ibm\cognos\tm1web\bin64\ssl.

Stop the IBM Planning Analytics Spreadsheet Service.
Open d:\Program Files\ibm\cognos\tm1web\wlp\usr\servers\tm1web\ in notepad++.
Update this row to set your https port
<httpEndpoint id=”defaultHttpEndpoint” httpPort=”-1″ httpsPort=”9511″ host=”*” removeServerHeader=”true”>
Add this row to point out the certificate pfx file to use
<keyStore id=”defaultKeyStore” location=”${wlp.user.dir}/../../bin64/ssl/cert.pfx” password=”cognos” />
Change cognos to the password you have for your pfx file.
Save the file as server.xml
In a command prompt go to folder d:\Program Files\ibm\cognos\tm1web\jre\bin
Enter this command to import the standard TM1 server cert to the new keystore
keytool -importcert -keystore ..\..\bin64\ssl\cert.pfx -storepass cognos -storetype pkcs12 -noprompt -alias ibmtm1 -file ..\..\bin64\ssl\ibmtm1.arm

Copy your Root and Intermediate certificate files to your \tm1web\bin64\ssl\ directory

Import the Root and Intermediate certificates with this command:
keytool.exe -import -trustcacerts -file “..\..\bin64\ssl\root.cer” -keystore “..\..\bin64\ssl\tm1store” -alias ca -storepass applix
keytool.exe -import -trustcacerts -file “..\..\bin64\ssl\issuing.cer” -keystore “..\..\bin64\ssl\tm1store” -alias intca -storepass applix

CER or PEM files should both work.

Start your IBM Planning Analytics Spreadsheet Service.

You need to browse to you TM1 APP WEB ( application, and click on Administration icon. Mark the TM1 Application Web client row, and click on edit.
Change the thinclient URL to be
Click OK and OK, to exit the settings.


Connect to your Linux server with PUTTY program.
Stop your paw with command: sudo ./ stop
Go to your /data/ibm/paw63 folder.
Run below command to request a certificate:
sudo openssl req -newkey rsa:2048 -nodes -keyout privatekey.pem -out paw.csr
Answer the questions, and you have your file.
Copy the paw.csr file to your CA authority, or IIS website, and repeat previous process to get a certificate. Save the file as Base 64 encoded certificate chain.

Copy your certnew.p7b file to linux server folder /data/ibm/paw63.

Copy your private key to a new pem file:
sudo cp privatekey.pem pa_workspace.pem
Change access to files with command:
sudo chmod 777 pa_workspace.pem

Add the certificates to the pem file:
sudo openssl pkcs7 -print_certs -in certnew.p7b >> pa_workspace.pem
Erase the not needed lines, with servernames etc, in the pem file:

sudo nano pa_workspace.pem


Copy the pa_workspace.pem file to the config folder:
sudo cd /data/ibm/paw63/config
sudo mv pa-workspace.pem pa-old-workspace.pem
sudo cp /data/ibm/paw63/pa_workspace.pem pa-workspace.pem

Add lines to paw.env file:

sudo nano paw.env

add this lines

export EnableSSL=true


also change to HTTPS instead of HTTP, in lines like export TM1ApplicationsLocation=”″

Save the file.
Copy the ca.cer, issuing.cer and root.cer files to folder /data/ibm/paw63/config/certs.
Go to the scripts folder
sudo cd /data/ibm/paw63/scripts
Run the process to import the certificate in the paw keystore:
sudo ./

Start paw with command:
sudo ./

If this is a new installation, you need to update D:\Program Files\ibm\cognos\analytics\webcontent\bi\pmhub.html file with HTTPS values.

// Update the following to point to the location of the pmhub service(s)
var pmhubURLs = [“https://pawservername”,””];


Open a cmd prompt as administrator.
Go to “C:\Program Files (x86)\ibm\cognos\fm\bin\” folder.
Copy the ca.cer file to the same folder.
Enter this command:
ThirdPartyCertificateTool.bat -i -T -r ca.cer -p NoPassWordSet

More information:

Securing Jupyter Notebook Server – IBM Documentation

TM1WEB, an error has occurred when using TLS