Question about Framework Manager 11.1.7 over the top install of 11.1.3

[Penny]

Yesterday we upgraded our Cognos DEV environment from version 11.1.3 to 11.1.7 FP3 with success.  The documentation was good and the over the top install went well.
We also tried an Framework Manager over the top upgrade in the same environment but had trouble saving 32  bit config and determined that it was because the cert directory was overridden.
I should have saved the configuration folder first and did not.   As a result I restored to our snapshot and am about to repeat the process.

This did NOT happen with the server install, the keystore was perfect afterwards and no extra work was required.  I tried to find some specific documentation for upgrading Framework Manager and am having trouble finding what I need.

Can anyone offer advice or a link to a good article regarding this?  Our next step will be to upgrade Transformer as well so also seeking advice on that upgrade.  For all of these we are moving from 11.1.3 to 11.1.7FP3.

Thank you in advance for any help.

Penny

[dougp]

I upgraded from 11.0.13 to 11.1.7 and saw the same behavior:  The server installs over the top, but FM doesn't.  I have this note from the instructions I produced for my upgrade process.


          Framework Manager does NOT install over the top of the old installation. Doing so will mess up the SSL configuration.


I did a fresh install and redid the SSL config.  This was OK for me because we are our own CA.  May cost a little if you need to pay for your certs.

[Penny]

Thank you fDoug or that confirmation.

Couple of questions:

1.  If I save my certs folder from configuration folder in the FM install and then restore it afterwards this should work should it not, or should we regenerate our ssl certs as we also use an internal CA.
2.  I am assuming I will have the same trouble when I upgrade Transformer, and wondered if anyone had experience with that.

Thanks

[dougp]

I think with a new install you'll need a new cert request, so just trying to use your old certs won't work.  There may be some hackery to make this work.  I think there's an install ID file (like <install_location>\model\configuration\certsINSTALLID_1c009d05-d5ca-48cc-9632-983133562834) and some text files and maybe your keystore reference this ID.  Maybe if you track all of the references and find a way to maintain them through the install/config, you can reuse your old certs.  Lots of maybes.  Seems hinky.

[Penny]

Thanks Doug.

It is not a new install but in our DEV environment we also installed Framework Manager.  So we upgraded the server okay from 11.1.3 to 11.1.7 but now need to do the same with FM on the same server.  So what I wondered was if i save my certs folder and repeat the over the top install, then restore the certs folder if you think that would work.  I have asked IBM but no answer yet. 

If I do have to regenerate the 32 bit install keystore on the same server (it is different that the server 64 bit keystore I believe), do you have the steps handy?   I would have to use the same certificates that I used for the CA server 64 bit install keystore.

Thank you very much for your expertise.

[dougp]

now need to do the same with FM on the same server

FM is the client tool.  I wouldn't know about installing it on the server.

To simplify my user experience, I have FM installed 3 times on my workstation -- once for each environment.  That way I'm not always opening Cognos Configuration.  The good news here:  Once I had my Dev install configured to use SSL, I copied the install for QA and Production, opened Cognos Configuration once (each) to change which server it pointed to, and I was done.  It works because the SSL cert is for the client machine.  Plus, by copying rather than installing again, I didn't get a new INSTALLID.

I have instructions, but they are probably customized to my environment.  They are on an internal wiki.  A simple copy-paste into this forum probably won't work well.  Basically, follow IBM's instructions regarding the process and using ThirdPartyCertificateTool.

[Penny]

Thank-you and yes I understand, however one more question (hoping for direction...fingers crossed).
We do have Framework Manager installed on one of our servers - the Application Server (not the Gateway) in our DEV environment.
Last week I upgraded the server and also renewed the SSL certs - gateway and application server up and running everything okay.

However with the 32 bit Framework manager on the same machine  - how do I add the refreshed encryption certificate to the keystore without generating another CSR and another cert (it would be for the same server)?

Have asked IBM The same but no answer yet.

Thanks

[Penny]

So to clarify my question:


Do I generate another SSL certificate for the 32 bit keystore for Framework Manager using the ThirdPartyCertificateToo.bat (that SSL certificate just expired), or is there a way that I can use the one I already generated for the 64 bit keystore on the same server?

Thank-you

[Penny]

RESOLVED:

Had 15 min with IBM  - we copied the csk and cert folder from the 64 bit install to the 32 bit install and therefore avoided creating another cert.  As per IBM this is not the recommended method but it worked fine.  As I suspected it is the generation of the CSR that creates the camkeystore and the key.

Thanks all!