CAM-CRP-1064 Unable to process the PKCS #7 issue in cognos 10.2.1 v

[nagoole]

Hi All,

When i try to TEST DS connection in cognos 10.2.1  its Got succeed but it some time getting below error


(PRS-CSE-1255

Exception error encountered in data decryption.


com.cognos.accman.jcam.crypto.CAMCryptoException : CAM-CRP-1064 Unable to process the PKCS #7 data because of an internal error. Unable to find the common symmetric key with alias 'F8kNGwCS37NprPrcHkCOsQX4SL8=' in the keystore 'D:/ibm/cognos/cognos 10.2.1_64/configuration/csk\jCSKKeystore'.)

We tried to resolve this Regenerating keys and rebooted the services also but Still the issue came

Any one please help to resolve this issue.

[cognoslearner1]

The only object associated with a Data Source that requires decryption is the Signon, therefore this issue can likely be resolved by deleting the Signon object (which falls below a Connection with the Data Source) and then recreating it.
Ensure that you know the user name, password and members list of the original Signon before deleting it.

Cheers,
Cognoslearner1

[nagoole]

Sorry to include the below comments on my post

I am getting this issue for all DS connection while testing.

[charlie]

Did you try this?

http://www-01.ibm.com/support/docview.wss?uid=swg21341609

[nagoole]

Yes I did that too but same issue.

[r_aldrich]

I am also experiencing this issue and am searching for resolution. 

I am in the process of deploying a new install of 10.2.2 and noticed in the <coginstall>/configuration folder, the encryptkeypair & signkeypair folders are not created.  The new 10.2.2 instance is being installed on same server as existing 10.2.1, its going into new directory with different port assignments.  Upon saving the cogstartup.xml new encryption folders are not created. I discovered the issue when importing a password protected deployment file from 10.2.1 and received this error: "CAM-CRP-1064 Unable to process the  PKCS #7 data".

Reference #: 1341609                                                   
http://www-01.ibm.com/support/docview.wss?uid=swg21341609 As per the document, I renamed cogstartup.xml and csk folder and redid the configuration.   The missing folders Were not CREATED.

This is a windows 2008 Single JVM environment, for testing.   The impact is significant as the only work around I see is to create 300 database connections manually.

[sunosoft]

Try re-configuring everything in congnos configurtion. Rename the cogstartup.xml file. Open the configuration new cogstartup.xml will be generated. Then re-configure everything manually.

[r_aldrich]

I have done a complete new configuration as you suggested,    My problem persists.

I have even done a new installation of BI Server on my laptop (windows 7) and on AIX (7.1) , in all cases the encryption folders are not created.   

[AussiePete2011]

Hi there

What are you using as the content store?
Have you tried to do a self contained installation with Derby?
This means you also need to create the Notification store at the command line

1.   Ensure that your Apache Derby Network Server is running.
2.   Start the ij utility using the ij.bat or ij.ksh script file.
3.   Connect to the Apache Derby database by typing the following ij utility command:

connect 'jdbc:derby://<servername>:1527/ns;user=cognos;password=cognos;create=true';
4.   Initiate Notification store using script
run 'D:\Apps\IBM\c1011_cm\configuration\schemas\delivery\Derby\NC_CREATE_Derby.sql';

This will allow you to see if the issue is with the Content store communications.
Cheers
AussiePete

[r_aldrich]

Thanks for the responses, I am still working through this issue 

[ to answer your question, this is going on a windows 2008 R2 test server, which also runs SQLServer 2008 and holds the content store.  So its a Single Server Install, I am using IIS 7.5 for the gateway and the standard IBM config with tomcat for the dispatchers.  Once I get it working here, I will do a distributed deployment to AIX 7.1 / Oracle content store / Websphere 8.5.5   UNIX is not my strength so that's why I am trying to get it to run in Windows first.  ]

I honestly think the issue is with the default cogstartup.xml file which is included with 10.2.2
I have involved IBM support and have asked them, why parameters for signkeypair and encryptkeypair are not included in the default cogstartup.xml file?

New Cryptography options are included in 10.2.2 , but I am not yet understanding how to enable them.  When I launch IBM Cognos Configuration and compare the Cryptography Configuration screens between 10.2.1 and 10.2.2, I see a new option in 10.2.2, but I don't see any signing or encryption key settings,   Reading the installation and configuration guide, but it's is still not clear to me how to get the options for the encryption folders to reappear.   Do I need to edit XML in cogstartup.xml ?  If any one has been through this issue, I would appreciate a little guidance on this.  Thanks,  Hopefully IBM support will have an answer, its only been 3 days now. 

[r_aldrich]

Based on what I know now... this issue should probably be on its own as its not really related to corrupted encryption folders.
Is there a way to move the last few replies to a new subject?

[r_aldrich]

I did not see an easy way to create new topic, so I did it with copy and paste
If you want to follow this 10.2.2 config issue, please find the New topic here >>

http://www.cognoise.com/index.php/topic,26655.0.html