Product:
IBM Cognos Controller 10.2.1 FAP
C8BISRVR_UPDATE_version=C8BISRVR-AW64-ML-RTM-10.2.5002.78-0
C8BISRVR_UPDATE_name=IBM Cognos Business Intelligence Server Update
CONTRL_UPDATE_version=CCR-AW64-ML-RTM-10.2.5003.68-0
CONTRL_UPDATE_name=IBM Cognos Controller Update
Microsoft Windows 2008 R2 Server

Problem:
After update of certificate on TM1 server, the FAP will not work.

Error message:
2016-10-15 13:36:58,382 [schedulerThread] INFO Scheduler – FAP service started
2016-10-15 13:37:31,251 [schedulerThread] ERROR Scheduler – Could not logon to TM1
com.ibm.cognos.tm1.TM1Exception: SystemServerNotFound
at com.ibm.cognos.tm1.API.getServerSecurityMode(Native Method)
at com.ibm.cognos.fap.common.persistence.tm1.TM1Context.preLoginCheckIfCAM(TM1Context.java:62)
at com.ibm.cognos.fap.service.schedule.Scheduler.updateDatamarts(Scheduler.java:454)
at com.ibm.cognos.fap.service.schedule.Scheduler.run(Scheduler.java:230)
at com.ibm.cognos.fap.service.schedule.Scheduler$1.run(Scheduler.java:144)
at java.lang.Thread.run(Thread.java:781)

Solution:
You have the FAP service installed on the Cognos Controller server, and not the TM1 10.2.2 server.
Then there is a TM1 client installed on the Cognos Controller server that also need to have the certifikate updated.

Stop the Cognos services.
Backup the folder D:\Program Files\ibm\cognos\tm1_64\bin64\ssl and D:\Program Files\ibm\cognos\tm1_64\bin\ssl

Download the updated TM1 SSL Certificates from the following location: http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FInformation+Management%2FCognos+TM1&fixids=BA-CTM1-SSL-ZIP-IF001

Extract the downloaded file/archive and extract it to any directory. For the purpose of this document, our files will be extracted in to <tm1_client_install_dir>\tm1_64\NewSSLCerts\

Copy the contents of the folder you extracted earlier <tm1_client_install_dir>\tm1_64\NewSSLCerts\ , and place them inside of the 2 directories listed above in Step 4. During this process, you will be required to REPLACE all conflicting files as we must replace the old certificate files with new ones.

 

After all files have been copied successfully, navigate to <tm1_client_install_dir>\tm1_64\bin\ssl\

Execute the uninstallSSL.bat file, to uninstall old keys from the Windows Keystore

If uninstallSSL.bat does not exist, run importsslcert.exe -remove from Command Line

Execute the importsslcert.exe file, to install the new keys in to the Windows Keystore
Start the Cognos services.

Start IBM Cognos FAP service.

Login to IBM Cognos Controller Financial Analytics Publisher and do a initial publish by click on START in the Data Marts tab.

If it works, then the certificate it replaced good.