Certificate Expiration FAQ

chanaveer_k · ‎05-31-2019

At the end of December, 2019, any authentication certificates generated using the Certificates app in the Anaplan My Account page will no longer be supported by Anaplan. The certificates will technically continue working till Feb 25th 2020, but Anaplan support team will not accept support tickets for these Certificates. Anaplan will not be issuing new certificates at the end of this year. If you are using an Anaplan issued certificate, you will need to take action.

Integration Client	Current Authentication Method	Action Required?
Anaplan Connect 1.3.3.5 or lower	Anaplan Certificate	Yes
Informatica Anaplan Connector	Anaplan Certificate	Yes
Snaplogic 1.x	Anaplan Certificate	Yes
Tableau 1.0	Anaplan Certificate	Yes
Any client	Anaplan Certificate	Yes
Anaplan Connect 1.4.x	Basic Authentication \ CA Certificate	No
Informatica Anaplan Connector	Basic Authentication \ CA Certificate	No
Mulesoft 2.x	Basic Authentication \ CA Certificate	No
Snaplogic 2.x	Basic Authentication \ CA Certificate	No
Boomi 1.x	Basic Authentication	No
Boomi 2.x	Basic Authentication \ CA Certificate	No
Any client	Basic Authentication \ CA Certificate	No

If your integration client and authentication method has a "Yes" in the "Action Required" column, then you must take action prior to December-end, 2019 to prevent disruption to your integrations.

Note that web login, web SSO, and basic authentication to integrations are not impacted by this event. We recommend that you make changes as possible and give yourself time to update & test your integrations.

Anaplan-Issued Certificate Expirations

What is happening?

Anaplan issued certificates will not be supported beyond end of Dec-2019, and will also not be renewed. Please note that, although Anaplan issued certificates show an expiry date of Feb 25th 2020, Anaplan will not provide support for them beyond end of Dec-2019.

Why is this change happening?

As the Anaplan platform evolves, we are always looking to provide our customers with more features and ways to integrate with Anaplan. The new Anaplan APIs and integration connectors leverage Certificate Authority (CA) issued certificates. Certificate Authority (CA) authentication offers a certificate hierarchy known as the "chain of trust" that enables you to verify the validity of a certificate issuer. This aligns with industry standards and provides a higher level of security for Anaplan customers.

How can you check if this impacts you and what steps do you need to take?

This change will impact your integrations if you are using Anaplan Certificates for authentication. After December 2019, you will have 2 options to continue running your integrations:

Switch to updated integration connectors or clients that support CA certificates. Procure a supported CA certificate and use that for authentication. If your integration connector or client already supports CA certificates, you only need to use that option.
Switch to basic authentication with your existing integration connector or client

General Questions

Can we change the expiration date of existing Anaplan Certificates?

No, the expiration date for a certificate cannot be changed. The date is fixed to Feb 25th 2020.

What are the benefits of using Certificate Authority (CA) certificates?

As the Anaplan platform evolves, we are always looking to provide our customers with more features and ways to integrate with Anaplan. The new Anaplan APIs and integration connectors leverage Certificate Authority (CA) issued certificates. CA authentication offers a certificate hierarchy known as the "chain of trust" that enables you to verify the validity of a certificate issuer. This aligns with industry standards and provides a higher level of security for Anaplan customers.

Newer Anaplan integration connectors & clients use token-based authentication enabled by CA Certificates. Tokens are an industry standard way of securing sessions.
Users can leverage their own certificates from a trusted Certificate Authority that ends with a supported Root CA Certificate.
Users have more control over CA certificates and can now specify the expiration dates for their certificates.
Users have the ability to disable the cert themselves through a new interface on Administration.
Newer Anaplan integration connectors & clients use v2.0 Anaplan APIs. v2.0 APIs support CA certificates and do not support Anaplan certificates. Future API enhancements will be made to this version of API.
These certificates can be obtained through your company's intermediary CA (typically issued by IT) or by purchasing it from a trusted Certificate Authority.

Which clients support CA certificates?

Anaplan Connector for MuleSoft	CA Authentication support is available.
Anaplan HyperConnect	CA Authentication support is available.
Anaplan Connector for Informatica Cloud	CA Authentication support is available.
Anaplan Connector for Boomi	CA Authentication support is available. Please contact DELL for more details.
Anaplan SnapLogic Integration	CA Authentication support is available. Please contact SnapLogic for more details.
Tableau Connector for Anaplan	Contact your Tableau representative for the updated connector availability date.

Note: consult individual user guides for any additional steps required to implement CA certificates in Anaplan.

How to get Certificate Authority (CA) certificates

The following links will guide you through the procurement and registration of CA-issued certificates in Anaplan:

Users can use certificates issued by an Intermediary CA with any of these supported Root CAs.

Note that certificates from an Intermediary CA are typically managed by staff in your organization. If you are unsure about whether your intermediary certificate uses a supported Root CA, contact your internal IT staff.

Is there a cost for using CA Certificates?

You can obtain a CA certificate from your internal intermediary CA or purchase certificates from a Certificate Authority.

If you have an intermediate CA, you can issue the certificate yourself. Your IT team can advise on your internal processes for obtaining certificates based on an intermediate CA.

What about Single Sign-On (SSO)?

Accessing Anaplan via a browser with standard login or with SSO is not impacted by this change. This change only affects data integration clients.

If Anaplan Connect runs actions for models in a workspace using single sign-on, we recommend using Certificate Authority (CA) Authentication.
If Single Sign-on (SSO) is enabled, but the user has a requirement to bypass it and use basic authentication (username and password) instead, then the user must be configured as an Exception User. An Exception User can authenticate by username and password or by certificate, rather than through SAML. For more information, see Assign Exception Users in Anapedia.

Integrations and API Questions

What integration options and APIs are available?

Anaplan has two versions of Production REST APIs - v1.3 & v2.0. Anaplan Integration clients use one or both APIs. Authentication mechanisms with both API versions are:

v1.3 API:

Basic Authentication
Authentication with Anaplan Certificates (Anaplan Certificates will expire by Feb 25th 2020)

v2.0 API:

Basic Authentication
CA Certificate based authentication

Does Anaplan support custom Integration clients?

If you have developed your own integration client to Anaplan, or are using a custom integration client developed by a partner or system integrator, the impact depends on what API version was used to develop your connector and the authentication method used. If you are using basic authentication to authenticate to Anaplan via integrations, you're not impacted.
If your custom integration client was developed using API v1.3 and you authenticate with Anaplan-issued certificates, you will not be able to do so after the expiration. If you want to use a CA certificate, you need to update your custom client to use API v2.0. If you do not wish to update your custom Integration client, then you must switch to Basic Authentication using user ID & password.

More information about the v2.0 Integration API can be found here: https://anaplanbulkapi20.docs.apiary.io

Anaplan Connect Questions

What if you are using Anaplan Connect (AC) for Integrations?

If you are using Basic Auth (user ID and password) in AC 1.3.x.x. scripts, you can continue to do so. You can upgrade to AC 1.4.x at your convenience.

If you are currently using an Anaplan issued certificate, one option is to keep both AC 1.3.x.x and AC 1.4.x installed at the same time, and migrate your integration scripts one-by-one to AC 1.4.x prior to the end of the year.

AC 1.4.x supports authentication with CA Certificates and Basic Auth. Existing Anaplan Certificates (downloaded from Anaplan UI) are not compatible with AC 1.4.x. Please review this blog post for steps to port AC 1.3.x.x Integration scripts to AC 1.4.x: https://community.anaplan.com/t5/Knowledge-Base/Migrating-from-Anaplan-Connect-1-3-x-x-to-Anaplan-Co...

You can take the Anaplan Connect online training from Anaplan Academy: https://community.anaplan.com/t5/Academy-Classes/Data-Related-Training-Classes/ta-p/19566

You can find the Anaplan Connect 1.3.3.5 user guide here.

Is JAVA keystore mandatory for using CA certificates with Anaplan Connect 1.4.x?

Starting AC 1.4.1, JAVA keystore (JKS) has been made optional. Users can directly refer to CA certificate files in their integration scripts or create a JKS if they prefer. Refer to 'Certificate Authentication' section of AC 1.4.x user guide for more details & implementation steps: https://s3.amazonaws.com/anaplanenablement/Community/Anapedia/Anaplan_Connect.pdf

How do you create a JAVA keystore for use with Anaplan Connect 1.4.x?

You can refer to following sources for information on creating JAVA keystore for use with Anaplan Connect v1.4.x:

Refer to section "Certificate Authentication using Keystore" in https://s3.amazonaws.com/anaplanenablement/Community/Anapedia/Anaplan_Connect.pdf
Refer to "Certificate Authentication Process" video recording at https://community.anaplan.com/t5/Videos/bg-p/Videos

Additionally, you can refer to the full Anaplan Connect online training at Anaplan Academy: https://community.anaplan.com/t5/Academy-Classes/Data-Related-Training-Classes/ta-p/19566

Haven't found the answer you were looking for?

Please post your questions in the Anaplan-Generated Certificates to Expire at the End of 2019 Discussion topic. Alternatively, you can contact your Anaplan Customer Success (CS) Business Partner, they will relay the question to the right contact.