At the end of December, 2019, any authentication certificates generated using the Certificates app in the Anaplan My Account page will expire. Anaplan will not be issuing new certificates at the end of this year. If you are using an Anaplan issued certificate, you will need to take action.
Integration Client
Current Authentication Method
Action Required?
Anaplan Connect 1.3.3.5 or lower
Anaplan Certificate
Yes
Informatica Anaplan Connector
Anaplan Certificate
Yes
Snaplogic 1.x
Anaplan Certificate
Yes
Tableau 1.0
Anaplan Certificate
Yes
Any client
Anaplan Certificate
Yes
Anaplan Connect 1.4.x
Basic Authentication \
CA Certificate
No
Informatica Anaplan Connector
Basic Authentication \
CA Certificate
No
Mulesoft 2.x
Basic Authentication \
CA Certificate
No
Snaplogic 2.x
Basic Authentication \
CA Certificate
No
Boomi 1.x
Basic Authentication
No
Boomi 2.x
Basic Authentication \
CA Certificate
No
Any client
Basic Authentication \
CA Certificate
No
If your integration client and authentication method has a "Yes" in the "Action Required" column, then you must take action prior to December-end, 2019 to prevent disruption to your integrations.
Note that web login, web SSO, and basic authentication to integrations are not impacted by this event. We recommend that you make changes as possible and give yourself time to update & test your integrations.
Anaplan-Issued Certificate Expirations
What is happening?
All Anaplan issued certificates are expiring by December-end 2019, and will not be renewed.
Why is this change happening?
As the Anaplan platform evolves, we are always looking to provide our customers with more features and ways to integrate with Anaplan. The new Anaplan APIs and integration connectors leverage Certificate Authority (CA) issued certificates. Certificate Authority (CA) authentication offers a certificate hierarchy known as the "chain of trust" that enables you to verify the validity of a certificate issuer. This aligns with industry standards and provides a higher level of security for Anaplan customers.
How can you check if this impacts you and what steps do you need to take?
This change will impact your integrations if you are using Anaplan Certificates for authentication. After December 2019, you will have 2 options to continue running your integrations:
Switch to updated integration connectors or clients that support CA certificates. Procure a supported CA certificate and use that for authentication. If your integration connector or client already supports CA certificates, you only need to use that option.
Switch to basic authentication with your existing integration connector or client
General Questions
Can we change the expiration date of existing Anaplan Certificates?
No, the expiration date for a certificate cannot be changed. The date is fixed to end of December 2019 (even if the certificate indicates another date).
What are the benefits of using Certificate Authority (CA) certificates?
As the Anaplan platform evolves, we are always looking to provide our customers with more features and ways to integrate with Anaplan. The new Anaplan APIs and integration connectors leverage Certificate Authority (CA) issued certificates. CA authentication offers a certificate hierarchy known as the "chain of trust" that enables you to verify the validity of a certificate issuer. This aligns with industry standards and provides a higher level of security for Anaplan customers.
Newer Anaplan integration connectors & clients use token-based authentication enabled by CA Certificates. Tokens are an industry standard way of securing sessions.
Users can leverage their own certificates from a trusted Certificate Authority that ends with a supported Root CA Certificate.
Users have more control over CA certificates and can now specify the expiration dates for their certificates.
Users have the ability to disable the cert themselves through a new interface on Administration.
Newer Anaplan integration connectors & clients use v2.0 Anaplan APIs. v2.0 APIs support CA certificates and do not support Anaplan certificates. Future API enhancements will be made to this version of API.
These certificates can be obtained through your company's intermediary CA (typically issued by IT) or by purchasing it from a trusted Certificate Authority.
Which clients support CA certificates?
Anaplan Connector for MuleSoft
CA Authentication support is available.
Anaplan HyperConnect
CA Authentication support is available.
Anaplan Connector for Informatica Cloud
CA Authentication support is available.
Anaplan Connector for Boomi
CA Authentication support is available. Please contact DELL for more details.
Anaplan SnapLogic Integration
CA Authentication support is available. Please contact SnapLogic for more details.
Tableau Connector for Anaplan
Contact your Tableau representative for the updated connector availability date.
Note: consult individual user guides for any additional steps required to implement CA certificates in Anaplan.
How to get Certificate Authority (CA) certificates
The following links will guide you through the procurement and registration of CA-issued certificates in Anaplan:
How to procure certificates.
How to manage them in Anaplan.
Users can use certificates issued by an Intermediary CA with any of these supported Root CAs.
Note that certificates from an Intermediary CA are typically managed by staff in your organization. If you are unsure about whether your intermediary certificate uses a supported Root CA, contact your internal IT staff.
Is there a cost for using CA Certificates?
You can obtain a CA certificate from your internal intermediary CA or purchase certificates from a Certificate Authority.
If you have an intermediate CA, you can issue the certificate yourself. Your IT team can advise on your internal processes for obtaining certificates based on an intermediate CA.
What about Single Sign-On (SSO)?
Accessing Anaplan via a browser with standard login or with SSO is not impacted by this change. This change only affects data integration clients.
If Anaplan Connect runs actions for models in a workspace using single sign-on, we recommend using Certificate Authority (CA) Authentication.
If Single Sign-on (SSO) is enabled, but the user has a requirement to bypass it and use basic authentication (username and password) instead, then the user must be configured as an Exception User. An Exception User can authenticate by username and password or by certificate, rather than through SAML. For more information, see Assign Exception Users in Anapedia.
Integrations and API Questions
What integration options and APIs are available?
Anaplan has two versions of Production REST APIs - v1.3 & v2.0. Anaplan Integration clients use one or both APIs. Authentication mechanisms with both API versions are:
v1.3 API:
Basic Authentication
Authentication with Anaplan Certificates (Anaplan Certificates will expire by Dec-2019)
v2.0 API:
Basic Authentication
CA Certificate based authentication
Does Anaplan support custom Integration clients?
If you have developed your own integration client to Anaplan, or are using a custom integration client developed by a partner or system integrator, the impact depends on what API version was used to develop your connector and the authentication method used. If you are using basic authentication to authenticate to Anaplan via integrations, you're not impacted.
If your custom integration client was developed using API v1.3 and you authenticate with Anaplan-issued certificates, you will not be able to do so after the expiration. If you want to use a CA certificate, you need to update your custom client to use API v2.0. If you do not wish to update your custom Integration client, then you must switch to Basic Authentication using user ID & password.
More information about the v2.0 Integration API can be found here: https://anaplanbulkapi20.docs.apiary.io
Anaplan Connect Questions
What if you are using Anaplan Connect (AC) for Integrations?
If you are using Basic Auth (user ID and password) in AC 1.3.x.x. scripts, you can continue to do so. You can upgrade to AC 1.4.x at your convenience.
If you are currently using an Anaplan issued certificate, one option is to keep both AC 1.3.x.x and AC 1.4.x installed at the same time, and migrate your integration scripts one-by-one to AC 1.4.x prior to the end of the year.
AC 1.4.x supports authentication with CA Certificates and Basic Auth. Existing Anaplan Certificates (downloaded from Anaplan UI) are not compatible with AC 1.4.x. Please review this blog post for steps to port AC 1.3.x.x Integration scripts to AC 1.4.x: https://community.anaplan.com/t5/Knowledge-Base/Migrating-from-Anaplan-Connect-1-3-x-x-to-Anaplan-Co...
You can take the Anaplan Connect online training from Anaplan Academy: https://community.anaplan.com/t5/Academy-Classes/Data-Related-Training-Classes/ta-p/19566
You can find the Anaplan Connect 1.3.3.5 user guide here.
Is JAVA keystore mandatory for using CA certificates with Anaplan Connect 1.4.x?
Starting AC 1.4.1, JAVA keystore (JKS) has been made optional. Users can directly refer to CA certificate files in their integration scripts or create a JKS if they prefer. Refer to 'Certificate Authentication' section of AC 1.4.x user guide for more details & implementation steps: https://s3.amazonaws.com/anaplanenablement/Community/Anapedia/Anaplan_Connect.pdf
How do you create a JAVA keystore for use with Anaplan Connect 1.4.x?
You can refer to following sources for information on creating JAVA keystore for use with Anaplan Connect v1.4.x:
Refer to section "Certificate Authentication using Keystore" in https://s3.amazonaws.com/anaplanenablement/Community/Anapedia/Anaplan_Connect.pdf
Refer to "Certificate Authentication Process" video recording at https://community.anaplan.com/t5/Videos/bg-p/Videos
Additionally, you can refer to the full Anaplan Connect online training at Anaplan Academy: https://community.anaplan.com/t5/Academy-Classes/Data-Related-Training-Classes/ta-p/19566
Haven't found the answer you were looking for?
Please post your questions in the Anaplan-Generated Certificates to Expire at the End of 2019 Discussion topic. Alternatively, you can contact your Anaplan Customer Success (CS) Business Partner, they will relay the question to the right contact.
... View more
