Product:
Cognos Analytics 11.0.12
kit_version=11.0.12.18062512
kit_name=IBM Cognos Analytics
Microsoft Windows 2016 Server

Problem:
User can not login to Cognos.
Cognos service does not start.
https://www.ibm.com/support/pages/how-regenerate-cryptographic-keys-cognos-analytics-11

If you check, the CA certificate have expired.

You can check it by go to folder C:\Program Files\ibm\cognos\analytics\jre\bin
Start program ikeyman.exe
Click on open icon and go to folder C:\Program Files\ibm\cognos\analytics\configuration\certs
Open the file CAMKeystore

Enter the password (default: NoPassWordSet)
Double click on the personal certificate named encryption

There you see when the certificate is created and when it stop working, 2 years later.

Solution:
Start Cognos Configuration (on your Cognos Content Manager server) as an administrator.
First try by click SAVE icon, and then RESTART icon inside Cognos Configuration. If that does not help then do the other steps from Cognos Configuration program.
Stop the Cognos Service.

Export the Cognos Configuration to a text file. Select File – Export as.

Click Yes to export the content.
Name the file “backup.xml” and save it in the configuration folder.
Close Cognos Configuration program.
Move this files to a backup folder (c:\temp\backup)

C:\Program Files\ibm\cognos\analytics\configuration\cogstartup.xml
C:\Program Files\ibm\cognos\analytics\configuration\caSerial
C:\Program Files\ibm\cognos\analytics\configuration\certs\CAMCrypto.status
C:\Program Files\ibm\cognos\analytics\configuration\certs\CAMKeystore
C:\Program Files\ibm\cognos\analytics\configuration\certs\CAMKeystore.lock
C:\Program Files\ibm\cognos\analytics\temp\cam\freshness

Move this folder to a backup folder (c:\temp\backup\csk)
C:\Program Files\ibm\cognos\analytics\configuration\csk

In the c11\configuration folder, rename ‘backup.xml’ file to ‘cogstartup.xml’.
Open Cognos Configuration, save the configuration and start the services.

Repeat steps on all computers that have Cognos Analytics Server components installed.

Check the result by go to folder C:\Program Files\ibm\cognos\analytics\jre\bin
Start program ikeyman.exe
Click on open icon and go to folder C:\Program Files\ibm\cognos\analytics\configuration\certs
Open the file CAMKeystore
Enter the password (default: NoPassWordSet)
Double click on the personal certificate named encryption

Now is the Cognos self-signed certificate valid another two years.

More Information:
https://www.ibm.com/support/pages/how-regenerate-cryptographic-keys-cognos-analytics-11
https://www.ibm.com/support/pages/how-regenerate-cryptographic-keys-cognos-bi-1021-and-earlier
https://www.ibm.com/support/pages/node/523783

https://www.ibm.com/support/pages/how-add-3rd-party-ca-allow-ssl-between-components-ibm-cognos-analytics-11
https://www.ibm.com/support/pages/configuring-ibm-cognos-analyticsbi-https-enabled-web-server