Cognos 10 配置 CA的问题 （SSL,Https）

Cognos 10.2.0 如何配置Https访问？
 
请大神帮忙回答一下， 如果有配置步骤更是万分感谢！

1. 请问大神CA证书一定要买吗？Windows 自带的证书服务器可以使用吗？OpenSSL 可以吗？
2. 除了所有的HTTP改成HTTPs， 端口80改为443，还有其他地方改吗？
3. SSL 设置是否要使用双向身份验证？
4. 认证中心设置是否需要使用第三方CA？
 




 
 
并且官方Guide说这部分不属于Cognos范围， 只列出一段很简单的Cognos Configuration上的配置。Installation and Configuration Guide官方内容：

Configure IBM Cognos for SSL enabled Web servers

If you are using secure sockets layer (SSL) on your Web server, you must change the Gateway URI values in IBM Cognos Configuration to be able to access the portal.

To enable SSL on your Web server, you must obtain a Web server certificate signed by a Certificate Authority (CA) and install it into your Web server. The certificate must not be self-signed, because self-signed certificates will not be trusted by IBM Cognos components. For more information about using certificates with your Web server, see your Web server documentation. These certificates are not provided with IBM Cognos products.
To enable users to access the IBM Cognos portal using SSL, you must change the Gateway URI values in IBM Cognos Configuration for each computer where the Application Tier Components and Framework Manager are installed.




Procedure

1. Configure your Web server for SSL and start the Web server.
2. On each computer where the Application Tier Components or Framework Manager are installed, start IBM Cognos Configuration.
3. Under Local Configuration, click Environment, and change the Gateway URI value from http to https.
4. In the Gateway URI value, change the port number to the SSL port number defined for your Web server. For example, the default port number for SSL connections is usually 443.
5. Save your configuration, and restart your services.


Results

When you access the portal using https://servername:443/ibmcognos, you should be prompted to install a certificate.
To avoid being prompted by a security alert for each new session, install the certificate into one of your Web browser's certificate stores.