Product: 
TM1 10

Issue:

TM1 SSL expire again in June 2026.

Solution:

Follow IBM recommendations.

TM1 SSL Certificate Generation – ApplixCA – Instructions

This document provides a script and/or step-by-step manual instructions for generating and deploying new applixca TM1 SSL certificates.  The script can be used to automate the generation of new certificates.  The manual steps are available to help with an understanding of the steps that the script has automated.

Prerequisites

1. Download and Install OpenSSL

Download Win64 OpenSSL v4.0.1 from:
https://slproweb.com/products/Win32OpenSSL.html

Install to the default location: C:\Program Files\OpenSSL-Win64

The OpenSSL executable will be located at: C:\Program Files\OpenSSL-Win64\bin\openssl.exe

2. Other Requirements

• Administrative access to TM1 installation directories
• TM1 services stopped before beginning

Important Notes

• Password for CA key: applix
• Password for Java cacerts: changeit
• Password for tm1store: applix
• All commands should be run from a Command Prompt with administrative privileges

Automated Script:

For automated execution of these steps, use the included update-applixca-certs.bat script. The script performs all the above steps. To run the automated script:

1. Download the update-applixca-certs.bat file here
2. Place the update-applixca-certs.bat file in C:\Program Files\OpenSSL-Win64\bin\
3. Open Command Prompt as Administrator
4. Navigate to the C:\Program Files\OpenSSL-Win64\bin\ directory
5. Run: update-applixca-certs.bat
6. Follow the prompts to specify your TM1 SSL directory path, default C:\Program Files\ibm\cognos\tm1_64\bin64\ssl
7. After certificates have been generated, the updated ssl folder will need to be provided to any users of Architect / Perspectives
8. If using distributed installs, the updated ssl folders will need to be copied to additional installation directories
   1. Ensure all ssl folders are updated, including tm1store and cacerts files

Manual Instructions (what the automated script does):

Step 1: Set Environment Variables and Working Directory

1. Open Command Prompt as Administrator
2. Set the TM1_ROOT environment variable (replace with your actual TM1 installation path):

   set "TM1_ROOT=C:\Program Files\ibm\cognos\tm1_64"

3. Verify tm1sd.exe exists in the bin64 directory:

   dir "%TM1_ROOT%\bin64\tm1sd.exe"

4. Navigate to the OpenSSL bin directory (this will be your working directory):

   cd "C:\Program Files\OpenSSL-Win64\bin"

Note: The TM1_ROOT environment variable will be used in all subsequent commands. From this root path, the following paths are derived:

• bin64 directory: %TM1_ROOT%\bin64
• bin64 SSL: %TM1_ROOT%\bin64\ssl
• bin SSL: %TM1_ROOT%\bin\ssl
• Webapps SSL: %TM1_ROOT%\webapps\pmpsvc\WEB-INF\bin64\ssl
• Java keytool: %TM1_ROOT%\bin64\jre\7.0\bin\keytool.exe
• Java cacerts: %TM1_ROOT%\bin64\jre\7.0\lib\security\cacerts

Step 2: Backup Existing SSL Directories

Create backups of all SSL directories before making changes:

xcopy "%TM1_ROOT%\bin64\ssl" "%TM1_ROOT%\bin64\ssl_bkp\" /E /I /H /Y
xcopy "%TM1_ROOT%\bin\ssl" "%TM1_ROOT%\bin\ssl_bkp\" /E /I /H /Y
xcopy "%TM1_ROOT%\webapps\pmpsvc\WEB-INF\bin64\ssl" "%TM1_ROOT%\webapps\pmpsvc\WEB-INF\bin64\ssl_bkp\" /E /I /H /Y

Step 3: Delete Old Certificate Files

Delete the following files from the bin64\ssl directory:

del /q "%TM1_ROOT%\bin64\ssl\tm1admsvrcert.pem"
del /q "%TM1_ROOT%\bin64\ssl\tm1svrcert.pem"
del /q "%TM1_ROOT%\bin64\ssl\applixca.pem"
del /q "%TM1_ROOT%\bin64\ssl\applixca.der"
del /q "%TM1_ROOT%\bin64\ssl\applixca.crl"

Step 4: Create Certificate Authority (CA) Directory Structure

Create the CA structure in the OpenSSL bin directory (you should already be here from Step 1):

mkdir applixCA
mkdir applixCA\private
mkdir applixCA\newcerts
echo. > applixCA\index.txt
echo 01 > applixCA\serial

Step 5: Generate CA Private Key

Generate the CA private key (password: applix). Since you’re in the OpenSSL bin directory, use openssl.exe directly:

openssl.exe genrsa -des3 -out applixCA\private\applixcakey.pem -passout pass:applix 2048

Step 6: Generate CA Certificate

Create the CA certificate (password: applix):

openssl.exe req -new -x509 -days 3650 -key applixCA\private\applixcakey.pem -out applixCA\applixca.pem -subj "/C=US/ST=State/L=City/O=Organization/OU=Unit/CN=TM1 CA" -passin pass:applix

Step 7: Convert CA Certificate to DER Format

Convert the PEM certificate to DER format:

openssl.exe x509 -in applixCA\applixca.pem -outform DER -out applixCA\applixca.der

Step 8: Generate TM1 Server Certificate

Create the TM1 server certificate and key (password: applix):

openssl.exe req -new -nodes -out tm1svrcert.csr -keyout tm1svrcert.key -subj "/C=US/ST=State/L=City/O=Organization/OU=Unit/CN=localhost"

openssl.exe x509 -req -in tm1svrcert.csr -CA applixCA\applixca.pem -CAkey applixCA\private\applixcakey.pem -CAcreateserial -out tm1svrcert.crt -days 3650 -passin pass:applix

type tm1svrcert.crt tm1svrcert.key > tm1svrcert.pem

del tm1svrcert.csr
del tm1svrcert.crt
del tm1svrcert.key

Step 9: Generate TM1 Admin Server Certificate

Create the TM1 admin server certificate and key (password: applix):

openssl.exe req -new -nodes -out tm1admsvrcert.csr -keyout tm1admsvrcert.key -subj "/C=US/ST=State/L=City/O=Organization/OU=Unit/CN=localhost"

openssl.exe x509 -req -in tm1admsvrcert.csr -CA applixCA\applixca.pem -CAkey applixCA\private\applixcakey.pem -CAcreateserial -out tm1admsvrcert.crt -days 3650 -passin pass:applix

type tm1admsvrcert.crt tm1admsvrcert.key > tm1admsvrcert.pem

del tm1admsvrcert.csr
del tm1admsvrcert.crt
del tm1admsvrcert.key

Step 10: Create Certificate Revocation List (CRL)

Generate an empty CRL file (password: applix):

openssl.exe ca -gencrl -keyfile applixCA\private\applixcakey.pem -cert applixCA\applixca.pem -out applixCA\applixcacrl.pem -config nul -passin pass:applix

If this fails, create a basic empty CRL:

echo -----BEGIN X509 CRL----- > applixCA\applixcacrl.pem
echo -----END X509 CRL----- >> applixCA\applixcacrl.pem

Step 11: Copy Certificates to TM1 SSL Directories

Copy all generated certificates from the OpenSSL bin directory to the TM1 SSL directories:

To bin64\ssl:

copy /y applixCA\applixca.pem "%TM1_ROOT%\bin64\ssl\applixca.pem"
copy /y applixCA\applixca.der "%TM1_ROOT%\bin64\ssl\applixca.der"
copy /y applixCA\applixcacrl.pem "%TM1_ROOT%\bin64\ssl\applixcacrl.pem"
copy /y tm1svrcert.pem "%TM1_ROOT%\bin64\ssl\tm1svrcert.pem"
copy /y tm1admsvrcert.pem "%TM1_ROOT%\bin64\ssl\tm1admsvrcert.pem"

To bin\ssl (if exists):

copy /y applixCA\applixca.pem "%TM1_ROOT%\bin\ssl\applixca.pem"
copy /y applixCA\applixca.der "%TM1_ROOT%\bin\ssl\applixca.der"
copy /y applixCA\applixcacrl.pem "%TM1_ROOT%\bin\ssl\applixcacrl.pem"
copy /y tm1svrcert.pem "%TM1_ROOT%\bin\ssl\tm1svrcert.pem"
copy /y tm1admsvrcert.pem "%TM1_ROOT%\bin\ssl\tm1admsvrcert.pem"

To webapps SSL:

copy /y applixCA\applixca.pem "%TM1_ROOT%\webapps\pmpsvc\WEB-INF\bin64\ssl\applixca.pem"
copy /y applixCA\applixca.der "%TM1_ROOT%\webapps\pmpsvc\WEB-INF\bin64\ssl\applixca.der"
copy /y applixCA\applixcacrl.pem "%TM1_ROOT%\webapps\pmpsvc\WEB-INF\bin64\ssl\applixcacrl.pem"
copy /y tm1svrcert.pem "%TM1_ROOT%\webapps\pmpsvc\WEB-INF\bin64\ssl\tm1svrcert.pem"
copy /y tm1admsvrcert.pem "%TM1_ROOT%\webapps\pmpsvc\WEB-INF\bin64\ssl\tm1admsvrcert.pem"

Step 12: Update Java cacerts Keystore

Update the Java cacerts keystore with the new CA certificate (password: changeit):

cd "%TM1_ROOT%\bin64\jre\7.0\bin"

REM Remove existing applixca alias (ignore errors if not present)
keytool.exe -delete -alias applixca -keystore "..\lib\security\cacerts" -storepass changeit

REM Import new CA certificate
keytool.exe -import -trustcacerts -noprompt -file "%TM1_ROOT%\bin64\ssl\applixca.pem" -keystore "..\lib\security\cacerts" -storepass changeit -alias applixca

Find and Update All Other cacerts Files

Search for all cacerts files in the TM1 installation (excluding backups):

cd "%TM1_ROOT%"
dir /s /b cacerts | findstr /v /i "_bkp\ _backup\ backup\"

For each cacerts file found (other than the one just updated), copy the updated cacerts:

copy /y "%TM1_ROOT%\bin64\jre\7.0\lib\security\cacerts" "path\to\other\cacerts"

Step 13: Update tm1store Keystore

Update the tm1store keystore with the new CA certificate (password: applix):

cd "%TM1_ROOT%\bin64\jre\7.0\bin"

REM Remove existing applixca alias (ignore errors if not present)
keytool.exe -delete -alias applixca -keystore "%TM1_ROOT%\bin64\ssl\tm1store" -storepass applix

REM Import new CA certificate
keytool.exe -import -trustcacerts -noprompt -file "%TM1_ROOT%\bin64\ssl\applixca.pem" -keystore "%TM1_ROOT%\bin64\ssl\tm1store" -storepass applix -alias applixca

Find and Update All Other tm1store Files

Search for all tm1store files in the TM1 installation (excluding backups):

cd "%TM1_ROOT%"
dir /s /b tm1store | findstr /v /i "_bkp\ _backup\ backup\"

For each tm1store file found (other than the one just updated), copy the updated tm1store:

copy /y "%TM1_ROOT%\bin64\ssl\tm1store" "path\to\other\tm1store"

Step 14: Replace All SSL Folders

Search for all SSL folders in the TM1 installation (excluding backups):

cd "%TM1_ROOT%"
dir /s /b /ad ssl | findstr /v /i "_bkp\ _backup\ backup\"

For each SSL folder found (other than bin64\ssl which is the source):

1. Create a timestamped backup:

   xcopy "path\to\ssl\folder" "path\to\ssl\folder_bkp_YYYYMMDD_HHMM\" /E /I /H /Y

2. Copy updated certificates to the folder:

   xcopy "%TM1_ROOT%\bin64\ssl\*.*" "path\to\ssl\folder\" /Y

Step 15: Restart TM1 Services

After all certificates are deployed, restart your TM1 services

Verification

After completing all steps:

1. Verify certificates are present in all SSL directories
2. Ensure any distributed server or client installs have been updated with the newly generated certificates
3. Test TM1 connections to ensure SSL is working properly

Troubleshooting

OpenSSL Command Not Found

• Ensure Win64 OpenSSL v4.0.1 is installed from https://slproweb.com/products/Win32OpenSSL.html
• Verify installation at: C:\Program Files\OpenSSL-Win64\bin\openssl.exe
• All commands in this document use the full path to openssl.exe

Permission Denied Errors

• Run Command Prompt as Administrator
• Ensure TM1 services are stopped before modifying files

Certificate Import Failures

• Verify the certificate file exists and is readable
• Check that passwords are correct
• Ensure keystore files are not corrupted

Services Won’t Start

• Check TM1 logs for SSL-related errors
• Verify certificate files are in the correct locations
• Ensure certificate and key formats are correct

Enabling SSL Debug Logging

TM1 Admin Server:

• Edit %TM1_ROOT%\bin64\tm1admsrv-log.properties
• Update the rootLogger and logger sections from INFO to DEBUG:

  log4j.rootLogger=DEBUG, R1
  log4j.logger.TM1=DEBUG

• SSL debug logging is written to tm1admsrv_<datetimestamp>.log files in the bin64 directory

TM1 Server:

• Configure tm1s-log.properties file (located in same directory as tm1s.cfg)
• Add the following line:

  log4j.logger.TM1.Comm.SSL=DEBUG

• If file doesn’t exist, copy from sample directory:

  copy "%TM1_ROOT%\samples\tm1\PlanSamp\tm1s-log.properties" "path\to\your\tm1server\tm1s-log.properties"

• No restart required – changes take effect immediately
• SSL debug logging is written to tm1server.log file

More Information:

https://www.ibm.com/support/pages/node/7276835

Product:
Planning Analytics  TM1_version=TM1-AW64-ML-RTM-11.0.913.10-0

Windows Server 2019

Issue:

There are more than one IDE for TM1 now. How do I setup the browser based?

https://github.com/falconbi/tm1_ide

Solution:

On your windows laptop install node.js  – download the msi from https://nodejs.org/en/download 

Install the node-v24.18.0-x64.msi program to folder C:\Program Files\nodejs

Start powershell as administrator

Create a folder like IDE, go to that folder and enter below command:

git clone https://github.com/falconbi/tm1_ide.git

go to the new folder
cd tm1_ide

Remove security in powershell with command

Set-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy RemoteSigned

Run below to install

npm install

For native TM1 access, ensure the HTTPPortNumber are set in tm1s.cfg for your applications. If you use Admin with password apple, ensure that account exist in all your TM1 applications with the same password.

Go to folder  C:\ide\tm1_ide\config and create the text file servers.json in notepad++

Enter below text, and adjust it to your ip number to your TM1 server, and the user and password to use.

{
"adminHosts": [
{
"name": "MyLab",
"url": "http://192.168.1.220:5895",
"adapter": "direct-v11",
"loginServer": "proven_techniques",
"username": "admin",
"password": "apple",
"servers": ["24Retail", "proven_techniques"]
}
]
}

At servers row, list all the TM1 server you should access.

The port 5895 is for the TM1 admin service, that the IDE will talk to first.

Go to tm1_ide folder and copy file .env.example to .env

In the C:\ide\tm1_ide change the .env file to only contain one row

The port 8083 is the port the client will use for you to access it.

From powershell to start IDE enter

npm start

There you are with a new tool to edit TM1. There are a few to select from now – both free and paid for.

More Information from the different IDE:

https://cubewisecare.atlassian.net/wiki/spaces/AIAC1/overview

https://marketplace.visualstudio.com/items?itemName=TimGeilen.pa-code

https://github.com/bgregs514/tm1_ide

TM1 IDE has been replaced by vscode-tm1, a Visual Studio Code extension for TM1. While many of the ideas from this project have been carried forward into vscode-tm1, this project has been deprecated and will be left here for reference.

Open a shell (Powershell in this example) and run the following after cloning to install project dependencies:

npm install

npm start

• Electron for desktop experience
• NodeJS for core logic and integration
• Monaco for the development area

https://open-vsx.org/extension/flamey3t1/vscode-tm1-ide

TM1 IDE — The Complete IDE for IBM Planning Analytics / TM1

Author: flameY3T1

TM1 IDE turns VS Code into a full development environment for IBM Planning Analytics / TM1. Write TI processes and rules with real autocomplete and a server-backed compile check, browse and edit cubes and dimensions visually, run MDX, trace process call graphs, test processes without touching your data, and mirror everything to Git — all from one tree, across as many servers as you like.

If you’ve been switching between Architect, PAW, and a text editor, TM1 IDE replaces all three with a single, modern, keyboard-driven workflow. No prior VS Code experience required — this guide gets you running.

Why TM1 IDE

Most TM1 editors stop at “edit a process, push it back.” TM1 IDE goes further:

• Visual cube & dimension editing — pivot cubes, write back values, spread, and restructure hierarchies by drag-and-drop. Not just code.
• Server compile-check on save — bad code never reaches the server. The save is blocked, not silently broken.
• Configurable linter + formatter — per-server rule sets and severities: strict on Prod, relaxed on Sandbox.
• Call-graph & references — see the blast radius of a process before you change it.
• Git mirror — materialize processes and rules as files, with drift detection and diff.
• Fully localized — complete English and German UI.

Getting Started

Step 1 — Install

1. Open your favorite IDE (VS Code, Kiro, …).
2. Open Extensions (Ctrl+Shift+X), search for “TM1 IDE”, click Install.
3. Fully restart the IDE — a window reload is not enough.

A new TM1 Explorer icon appears in the activity bar — your main entry point.

https://www.tm1forum.com/viewtopic.php?t=15666

https://github.com/bgregs514/vscode-tm1/discussions/33

https://github.com/falconbi/tm1_ide

The Browser version of TM1 IDE

• Features
• Setup
• Keyboard Shortcuts
• Project Structure
• Architecture
• Authentication
• Deployment Pipeline
• IBM REST API Reference

For environments where TM1 is accessed through PAW, do below steps to connect:

cp .env.example .env

PAW_HOST=http://192.168.x.x
PAW_USERNAME=admin
PAW_PASSWORD=your_password
PAW_LOGIN_SERVER=Production
PORT=8083

# Optional: AI-powered MDX generation
ANTHROPIC_API_KEY=sk-ant-...

[
  { "name": "Production" },
  { "name": "Development" }
]

See Authentication for multi-host and advanced adapter setups.

npm start

Root cause: PAW validates all logins against one specific TM1 server — the TM1 Login Server — configured in PAW Admin Console → Configuration → TM1 Login Server URI. Users created on any other server are invisible to PAW auth.

Fix shipped:

• Added PAW_LOGIN_SERVER to .env and .env.example
• All 10 user/group routes in server.js now always target PAW_LOGIN_SERVER regardless of selected workspace server
• README updated with new “PAW Login Server” section

V12 note: TM1 Login Server is a V11-only concept. User management in the IDE must be adapter-aware — disabled or routed to IdP on V12/OIDC environments.

• PAW is not a separate user store — in TM1 native auth mode, TM1 }Clients IS the user store
• PAW has one designated TM1 Login Server for auth — all logins validated there (V11 only)
• PAW discovers TM1 servers via the TM1 Admin Host (port 5895 HTTP / 5898 HTTPS) — a separate service acting as a server registry. TM1 servers register themselves on startup
• PAW V12 replaces the TM1 Login Server concept with OIDC — identity comes from the IdP, not }Clients
• The TM1 Login Server constraint is V11-only

Admin Host discovery API (direct, reliable):

GET http://{adminhost}:5895/api/v1/Servers
GET https://{adminhost}:5898/api/v1/Servers

Source: TM1 Admin Server API

PAW proxy list API (unreliable):

GET {paw-host}/api/v1/tm1/Servers

Included in the IBM Postman collection but explicitly noted as “not exposed through the PAW proxy”. Do not depend on this without testing on your instance. tm1_paw_tree documents: “PAW has no endpoint to list TM1 server names”.

Arc connects directly to TM1 via the Admin Host, bypassing PAW entirely. For IBM Cloud / AWS, Arc uses IBM IAM API keys → Bearer tokens — direct Admin Host is blocked by cloud firewalls.

Key discovery: the TM1 OData path suffix is identical across all deployment types:

{base}/api/{pawVersion}/tm1/{database}/api/v1/{endpoint}

Only the auth mechanism, base URL, and PAW API version prefix change. Our existing PAW-proxy architecture is the right shape — it just needs pluggable auth underneath.

Read more in there documentation.

https://marketplace.visualstudio.com/items?itemName=CarpeDatum.tm1-helper 

https://github.com/falconbi/tm1_ide/blob/main/docs/REST%20API%20README%20.md

https://marketplace.visualstudio.com/items?itemName=tm1-oss.rest-client-tm1-dev

https://code.cubewise.com/software/products/arc/

https://workspace.google.com/marketplace/app/teamone/112725458607

https://omnitm1.com/

https://github.com/ACG-Code/ACG-Utilities-for-IBM-Planning-Analytics

https://getgreenshot.org/

https://marketplace.visualstudio.com/items?itemName=flameY3T1.vscode-tm1-ide

https://marketplace.visualstudio.com/items?itemName=TimGeilen.pa-code

Product:
Planning Analytics 2.1.19 for excel
Microsoft Windows 2022 server

Issue:

In a PAFE (PAX) report where a cell have a formula with @DBRW the cell is not updateable, you have to write the full value again. Is there a way to edit the text in a cell without destroying the formula?

Solution:

Place the cursor in the cell to update.

In Excel press F2 followed by F9 and then edit text in cell, press enter when done.

If you publish the excel report to TM1WEB, then in TM1WEB you can edit the cell direct and the values are stored in the cube.

More Information:

https://blog.quebit.com/blog/quebit-blog-mastering-the-tm1-dbrw-excel-function

https://www.wimgielis.com/tm1_articles_EN.htm

https://www.ibm.com/docs/en/planning-analytics/2.1.0?topic=view-editing-data-in-cube-cells

https://www.ibm.com/docs/en/planning-analytics/2.1.0?topic=reports-preserve-overwrite-dbrw-formulas-formula-mode 

https://www.ibm.com/docs/en/planning-analytics/2.1.0?topic=bymftppame-benefits-using-planning-analytics-microsoft-excel-over-tm1-perspectives

https://www.ibm.com/docs/en/planning-analytics/2.1.0?topic=websheets-websheet-overview 

https://www.howtogeek.com/dont-ignore-the-power-of-f4-in-microsoft-excel/