You may encounter an error : 400 - Invalid SNI when calling Talend Runtime API (Job as service) after installed 2025-02 patch or later. In the past before the patch version R2025-02 of Talend Runtime Server, it did work well when using the same certificate for SSL connection with Talend Runtime Server and did not cause any issue. 

The SNI validation is active after 2025-02 patch or later.

Resolution

There are three options to slove this issue

1. Obtain and install a proper certificate that references the correct host name and then access it with the hostname rather than by IP.
2. Disable SNI host check.
3. Tell Talend component to resolve IP as hostname

Disable SNI Host Check

This has the same security risk as jetty before it was updated (low security)

In <RuntimeInstallationFolder>/etc/org.ops4j.pax.web.cfg file, please add

jetty.ssl.sniRequired=false

and 

jetty.ssl.sniHostCheck=false

Or configuring these jetty parameters in <RuntimeInstallationFolder>/etc/jetty.xml or jetty-ssl.xml file

• Find the <New class="org.eclipse.jetty.server.SecureRequestCustomizer"> block in your jetty.xml or jetty-ssl.xml 
  
  
• Edit the <Arg name="sniRequired" ...> and <Arg name="sniHostCheck" ...> lines so that the properties' defaults are set to false as shown below:
  
  

  <New id="sslHttpConfig" class="org.eclipse.jetty.server.HttpConfiguration">
  <Arg><Ref refid="httpConfig"/></Arg>
  <Call name="addCustomizer">
  <Arg>
  <New class="org.eclipse.jetty.server.SecureRequestCustomizer">
  <Arg name="sniRequired" type="boolean">
  <Property name="jetty.ssl.sniRequired" default="false"/>
  </Arg>
  <Arg name="sniHostCheck" type="boolean">
  <Property name="jetty.ssl.sniHostCheck" default="false"/>
  </Arg>
  <Arg name="stsMaxAgeSeconds" type="int">
  <Property name="jetty.ssl.stsMaxAgeSeconds" default="-1"/>
  </Arg>
  <Arg name="stsIncludeSubdomains" type="boolean">
  <Property name="jetty.ssl.stsIncludeSubdomains" default="false"/>
  </Arg>
  </New>
  </Arg>
  </Call>
  </New>

  

Resolve IP to Hostname

If the certification includes the domain name, you should use that domain name instead of the IP with the Jetty security updates in Talend Runtime Server.

But if your DNS server does not resolve the IP, you must call it by the IP address, so please check it at first to see if the workaround is feasible for your current situation.

In the examples the hostname is unresolvedhost.net and the IP is 10.20.30.40.

Try this API call at the command line:

curl -k -X GET --resolve unresolvedhost.net:9001:10.20.30.40 https://unresolvedhost.net:9001/services/

or

curl -k -X GET -H "Host: unresolvedhost.net" https://10.20.30.20:9001/services/

If this works, in your Talend component that makes the API call, go to "Advanced settings" or "Headers" table, add a row with Key: Host and Value: The hostname that matches your SSL certificate (e.g. unresolvedhost.net)

This will instruct Talend to send the correct Host header, which most HTTP clients (including Java's HttpClient) will also use as the SNI value during the TLS handshake.
 

Cause

The SNI enforcement is there for a security reason. With the 2025-02 patch, the Jetty components on Talend Runtime Server resolved a CVE security issue where they allowed a hostname to connect to a server that doesn't match the hostname in the server's TLS certificate.

Certificates require the URI not to be localhost or an IP address, and to have at least one dot, so a fully qualified domain name is best.

Related Content 

 https://stackoverflow.com/questions/69945173/org-eclipse-jetty-http-badmessageexception-400-invalid-sni

Environment

Talend ESB 

This article is provided as is. For further customization or assistance, reach out to Qlik's Professional Services or engage in our Qlik Sense Administration and Configuration forum.

This details the steps required to use a Microsoft Excel (XLS) file as a User Directory in the User Directory Connector (UDC).

The instructions in this article are written for Microsoft Office 2016, which has reached end of life as of October 2025. As an alternative, use Microsoft 365 Access Runtime. See Download and install Microsoft 365 Access Runtime.

The required Microsoft Excel Driver may not be installed by default.  

1. Verify if the drivers are already installed on your server:
   
   Open the Windows Registry Editor and navigate to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\ODBC\
   
   
    

   

   
   
   If it is not installed, download the latest Microsoft package.
   
   This file can be directly sourced from the Microsoft Download site. The 64-bit version is required.
   
   Example: Microsoft Access Database Engine 2016 Redistributable
   
   
   
2. Run the installer
   
   
3. Refresh the registry editor and verify that the drivers are correctly installed
   
   
   
   
4. Create an XLS file that contains your users
   
   A sample XLS file is attached to this article:
   
   
   • This file contains two sheets, "MyUsers" and "Attributes"; they can be renamed to fit your naming convention
   • The first sheet contains two columns: "userid" and "name"; those names are important and mandatory.

     Do not change them, or the import will fail.

   • The second sheet contains three columns: "userid", "type", and "value"
     
     
5. Create a new UDC
   1. Navigate to your User Directory Connector in the Qlik Sense Management Console
   2. Create a new connection: Excel (via ODBC)
   3. Untick the checkbox Sync user data for existing users
   4. User table Name must match your first sheet ("[MyUsers$]" here)
   5. Attribute table name must match the second sheet ("[Attributes$]" here)
   6. Modify the connection string to point to your Excel file: DRIVER={Microsoft Excel Driver (*.xls, *.xlsx, *.xlsm, *.xlsb)};DBQ=C:\temp\SomeUsers.xls
      
      
      
      
6. Validate and check in the logs
   
   The following should be logged:
   
   Connection creation verified.
   Connection open verified.
   Tables verified.
   The userid field of the [MyUsers$] table is verified successfully.
   The name field of the [MyUsers$] table is verified successfully.   
   The userid field of the [Attributes$] table is verified successfully.   
   The type field of the [Attributes$] table is verified successfully.     
   The value field of the [Attributes$] table is verified successfully.  
   
   
7. Sync the UDC and check the logs
   
   Started synchronizing all users for ...
   Started syncing users
   ODBC dataReader have been successfully created
   Retrieved 3 entities from directory 'TEST' of type Repository.UserDirectoryConnectors.ODBC.OdbcExcel
   Database done with 3 users and 0 groups in user directory (TEST, ...)
   Ended saving users in repository
   Finished synchronizing all users for ...
   
   
8. Verify that the users were added in the Qlik Sense Management Console
   
   
   
   
9. Verify the attributes are reflected in the user's properties
   
   
   

Troubleshooting

The following errors you may be logged in C:\ProgramData\Qlik\Sense\Log\Repository\Trace\<SERVER>_UserManagement_Repository.txt
 

Verify that the name and userid columns in the file are correctly named and have not been renamed. 

Environment 

• Any version of Qlik Sense

Instead of pulling the data from the Primary node, which can potentially negatively affect performance, we can force Qlik Replicate to connect to a secondary read-only node during Full Load.

To do so:

1. When starting the task for the first time, Qlik Replicate will connect to the primary database and create a publication with all required articles. Once the creation of the publication is finished and the articles are added to the publication, stop the task. 
   
   
2. Set a new Internal Parameter in the SQL server endpoint, routing the connections to the secondary node.
   
   Parameter: additionalConnectionProperties   
   Value:  ApplicationIntent=ReadOnly
   
   For more information regarding Internal Parameters, see  Qlik Replicate: How to set Internal Parameters and what are they for.
   
   
3. Start the reload. As soon as you finished the Full load, stop the task and remove the additional parameter which you added in Step 2.
   
   
4. Resume the task. All connections will now resume on the primary node. 

Environment

Qlik Replicate 

A binary load command that refers to the app ID (example Binary[idapp];) does not work and fails with:

General Script Error

or

Binary load fails with error Cannot open file

Before Qlik Sense Enterprise on Windows November 2024 Patch 8, the Qlik Engine permitted an unsupported and insecure method of binary loading from applications managed by Qlik Sense Enterprise on Windows.

Due to security hardening, this unsupported and insecure action is now denied.

Binary loads of Qlik Sense applications require a QVF file extension. In practice, this will require exporting the Qlik Sense app from the Qlik Sense Enterprise on Windows site to a folder location from which a binary load can be performed. See  Binary Load and Limitations for details.

Example of a valid binary load:

Binary [lib://My_Extract_Apps/Sales_Model.qvf];

Example of an invalid binary load:

"Binary [lib://Apps/777a0a66-555x-8888-xx7e-64442fa4xxx44];"

Environment

• Qlik Sense Enterprise on Windows November 2024 Patch 8 and any later releases

A third-party certificate was configured in the Qlik Sense Proxy, but is not being used.

The connection is not private" NET::ERR_CERT_COMMON_NAME_INVALID may be displayed on HUB access. 

Qlik Sense Enterprise on Windows uses self-signed and self-generated certificates to protect communication between services, as well as user web traffic to the hub and management console.  It is possible to use a third-party-issued SSL certificate to protect client web traffic. Using the self-signed certificate will cause a certificate warning to be displayed in the web browser (such as Google Chrome or Internet Explorer). 

If the third-party certificate for the Qlik Sense Proxy Service is not fully compatible with Qlik Sense or it does not have the correct attributes and cyphers, the Qlik Sense Repository Service will revert to using the default certificates. The following error may occur in the Proxy Security logs:

Example:  C:\ProgramData\Qlik\Sense\Log\Proxy\Trace\HOSTNAME_Security_Proxy.txt

No private key found for certificate 'CN=qliksense.domain.com' ([CERTIFICATE THUMBPRINT HERE]) Couldn't find a valid ssl certificate with thumbprint [CERTIFICATE THUMBPRINT HERE] Reverting to default Qlik Sense SSLCertificate Set certificate 'CN=qliksenseserver1.domain.com' ([CERTIFICATE THUMBPRINT HERE]) as SSL certificate presented to browser

Resolution:

In order for Qlik Sense Enterprise to correctly recognize the third-party certificate as valid, the certificate will have to meet the following requirements:

Note: Root and Intermediate CA certificates need to be correctly installed. Should any be missing, Qlik Sense proxy will not use the server certificate and will revert back to using the self-signed certificate instead.

Certificates that are known to work well with Qlik Sense have the following attributes:

• Certificates that are x509 version 3. More information including filename extensions under https://en.wikipedia.org/wiki/X.509 
• Use signature algorithm sha256RSA
• Use signature hash algorithm sha256
• Signed by a valid, and OS/browser configured , CA
• Are valid according to date restrictions (valid from/valid to)
• Key in format CryptoAPI (not in CNG)
• The certificate itself has to contain private key no matter what Qlik Sense version.

 Related Content:

How to: Change the certificate used by the Qlik Sense Proxy to a custom third party certificate 

 

After upgrading to Qlik Sense Enterprise on Windows May 2023 (or later), the Qlik Sense Repository Service may cause CPU usage spikes on the central node. In addition, the central Engine node may show an increased average RAM consumption while a high volume of reloads is being executed. 

The Qlik Sense System_Repository log file will read:

"API call to Engine service was successful: The retrieved 'StaticByteSize' value for app 'App-GUID' is: 'Size in bytes' bytes." 

Default location of log: C:\ProgramData\Qlik\Sense\Log\Repository\Trace\[Server_Name]_System_Repository.txt

This activity is associated with the ability to see the Base memory size in the Qlik Sense Enterprise Management Console. See Show base memory size of apps in QMC.

Resolution

The feature to see Base memory size can be disabled. This may require an upgrade and will require downtime as configuration files need to be changed.

Take a backup of your environment before proceeding.

1. Verify the version you are using and verify that you are at least on one of the versions (and patches) listed: 
   
   
   • May 2023 Patch 13
   • August 2023 Patch 10
   • November 2023 Patch 4 
   • February 2024 IR
     
2. Back up the following files:
   
   
   • C:\Program Files\Qlik\Sense\CapabilityService\capabilities.json
   • C:\Program Files\Qlik\Sense\Repository\Repository.exe.config
     
     *where C:\Program Files can be replaced by your custom installation path.
     
     
3. Stop the Qlik Sense Repository Service and the Qlik Sense Dispatcher Service
   
4. Open and edit the capabilities.json with a text editor (using elevated permissions)
   1. Open C:\Program Files\Qlik\Sense\CapabilityService\capabilities.json
   2. Locate: "enabled": true,"flag": "QMCShowAppSize"
   3. Change this to: "enabled": false,"flag": "QMCShowAppSize"
   4. Save the file  
5. Open and edit the repository.exe.config with a text editor (using elevated permissions)
   1. Open C:\Program Files\Qlik\Sense\Repository\Repository.exe.config
   2. Locate: </appSettings>
   3. Before the </appSettings> closing statement, add:
      <add key="AppStaticByteSizeUpdate.Enable" value="false"/>
   4. Save
6. Start all Qlik Sense services
7. Verify you can access the Management Console

If any issues occur, revert the changes by restoring the backed up files and open a ticket with Support providing the changed versions of repository.exe.config, capabilities.json mentioning this article. 

Related Content

Show base memory size of apps in QMC

Internal Investigation:

QB-22795
QB-24301

Environment

Qlik Sense Enterprise on Windows  May 2023, August 2023, November 2023, February 2024. 

NPrinting has a library of APIs that can be used to customize many native NPrinting functions outside the NPrinting Web Console.

Environment:

Qlik NPrinting 

An example of two of the more common capabilities available via NPrinting APIs are as follows

• Connection reloads
• Publish Task executions

These and many other public NPrinting APIs can be found here: Qlik NPrinting API

In the Qlik Sense data load editor of your Qlik Sense app, two REST connections are required (These two REST Connectors must also be configured in the QlikView Desktop application>load where the API's are used. See Nprinting Rest API Connection through QlikView desktop)

• GET
• POST

Requirements of REST user account:

• Windows Authentication is required in both these connectors. The required user account is the NPrinting service account (which is also ROOTADMIN on the Qlik Sense server)
• This user account must also be a member of the NPrinting 'Administrators' Security Role on the NPrinting Server.

Creating REST "GET" connections

Note: Replace QlikServer3.domain.local with the name and port of your NPrinting Server

NOTE: replace domain\administrator with the domain and user name of your NPrinting service user account

Creating REST "POST" connections

Note: Replace QlikServer3.domain.local with the name and port of your NPrinting Server

NOTE: replace domain\administrator with the domain and user name of your NPrinting service user account

Ensure to enter the 'Name' Origin and 'Value' of the Qlik Sense (or QlikView) server address in your POST REST connection only.

Replace https://qlikserver1.domain.local with your Qlik sense (or QlikView) server address.

Ensure that the 'Origin' Qlik Sense or QlikView server is added as a 'Trusted Origin' on the NPrinting Server computer

Related Content

• Distribute NPrinting reports after reloading a Qlik App
• Extending Qlik NPrinting
• Run a Qlik NPrinting API POST command via QlikView reload script
• Troubleshooting Common NPrinting API Errors

NOTE: The information in this article is provided as-is and to be used at own discretion. NPrinting API usage requires developer expertise and usage therein is significant customization outside the turnkey NPrinting Web Console functionality. Depending on tool(s) used, customization(s), and/or other factors ongoing, support on the solution below may not be provided by Qlik Support.

When upgrading to Qlik Talend Studio R2025-06v3 or later tSnowflakeRow with Snowflake-jdbc-driver-3.22.0 that uses the function LAST_QUERY_ID() in command always returns “Alter session set JDBC_USE_SESSION_TIMEZONE=false” instead of the the correct query id（query id last query ran）as a result. 

Resolution

To have LAST_QUERY_ID() return the last query and not the alter session query, it is required to modify the command to use LAST_QUERY_ID(-2).

For example: 

Select query used in tSnowflakeRow component

 "SELECT LAST_QUERY_ID() as LAST_QUERY_ID(-2);"

Cause 

In Studio R2024-04, a new checkbox "Use Session Timezone" was added to the tSnowflakeInput and tSnowflakeRow components. The default value is unchecked (Alter session set JDBC_USE_SESSION_TIMEZONE=false) to avoid Snowflake regression issue Incorrect timezone handling for java.sql.Time, However this does bring the side effect of snowflake functions like LAST_QUERY_ID() returning the wrong value.

Related Content

2025-04-studio-known-issues for 'Use Session Timezone' option in the Snowflake components

Environment

Talend Data Integration 

Creating a Qlik Sense Client-Managed connection | Migration Center Help documents all steps needed to create a Qlik Sense Client-Managed connection to the Qlik Analytics Migration Tool.

As a part of the System Requirements (System requirements | Migration Center Help), Qlik advises that the Qlik Sense Proxy service must have a valid third-party certificate.

This article explains the process to follow if no third-party certificate is available; for example, when setting up a test connection in your UAT or test environment. For this example, we will be using the self-signed certificate used by Qlik Sense. 

Securing the connection

The first challenge we need to overcome is the Not Secure alert when accessing Qlik Sense:

1. Run certlm.msc with elevated permissions (as Administrator)
   
   
   
   
2. Select Trusted Root Certification Authorities > Certificates > All Tasks > Import
   
   
   
   
3. Click Next
4. Select All Files and choose the root.pem stored in  C:\ProgramData\Qlik\Sense\Repository\Exported Certificates\.Local Certificates
   
   
   
   
5. Click Open and follow the onscreen instructions; when prompted for the Certificate Store choose the Trusted Root Certificate Authorities storage location
   
   
   
   
6. Confirm the CA cert was installed by refreshing the Trusted Root Certificate Authorities > Certificates list:
   
   
   
   
   
7. Close CertML and open https:// YOUR-HOST.domain.local/hub to confirm the connection is now displayed as Secured:
   
   
   
   

Connecting to the Qlik Analytics Migration Tool

Creating a Qlik Sense Client-Managed connection | Migration Center Help

To establish a connection to the Qlik Analytics Migration Tool in this example, we will be using Method 2 of the recommended steps: Create a virtual proxy using the tool | help.qlik.com.

1. In the Qlik Analytics Migration Tool, navigate to the Connections tab and select Qlik Sense Client-Managed
2. Click Create New
3. Switch to the Virtual Proxy Setup tab
4. In the Qlik Server URL field, enter the login URL of the Qlik Sense Client-Managed environment
5. Click Login to Qlik
   
   
   
   
6. After logging in, open your web browser's Developer Tools (F12 or fn + F12)
7. Go to the Application tab, expand Cookies, then select the Qlik Sense domain and copy the Cookie Name and Cookie Value
   
   
   
   
   
8. Paste the values into the Session Cookie fields in the Virtual Proxy Setup – Guide
9. Click Retrieve users and proxies from Qlik and confirm the message
   
   
   
   
10. In the Select Service User dropdown, select a RootAdmin user to associate with the virtual proxy
11. In the Select Proxy Service dropdown, select the proxy service (typically Central)
12. Optionally, set a Virtual Proxy Name (no spaces allowed)
13. Click Create Virtual Proxy
14. After proxy creation, a JWT token will be displayed (optional to save)
15. Click Go to Connection Setup 
    
    
    
    
16. Click Test Connection to validate the setup
17. Click Create Connection
18. A confirmation message will appear, and the connection will be added to the list
19. This step creates a Qlik Sense Converter connection

Environment

• Qlik Cloud Migration Tool
• Qlik Sense Enterprise on Windows
• Qlik Cloud Analytics

Is it possible to migrate users and data connections from one Qlik Cloud Analytics tenant to another?

You cannot migrate users and data connections from an existing tenant to a newly purchased tenant.

The following will need to be done:

• All data connections must be recreated
• Apps and scripts in the new tenant need to have their data connections updated to reference the new connections
• For users, it will be necessary to send new invitations or configure your identity provider to manage access to your new Qlik Cloud tenant

What about apps and scripts?

Apps can be migrated from one tenant to another using the following Qlik CLI automation: Migrate apps between Qlik Cloud tenants 

This tutorial is not exhaustive, and does not migrate other resources such as spaces, automations, data alerts, subscriptions, notes, etc. Qlik offers solutions via Qlik Professional Services for complete tenant to tenant migrations.

For scripts, follow the process of exporting them manually from the old tenant and then importing them to the new tenant. See Exporting scripts.

To make the process easier for you, Qlik's customer support team can link the newly purchased tenant license to a trial tenant, and you can continue to use the trial tenant. The trial tenant will be updated to a Standard, Premium, or Enterprise version after linking the license (depending on which package was purchased).

Do you need iterative planning and support assistance?

If you're looking to perform a manual transfer but need assistance with iterative planning or direct engagement by Qlik, our Professional Services are ready to assist.

Additional References

• Exporting apps | help.qlik.com 
• How to export QVD files from a Qlik Cloud Tenant 

Environment

• Qlik Cloud Analytics

Qlik Sense Enterprise on Windows can be set up with a central node and multiple rim nodes. See Installing a Qlik Sense rim node.

To remove a rim node at any point after setup:

1. Open the Qlik Sense Enterprise Management Console
2. Go to Nodes
3. Find the rim node you wish to remove 
4. Click Delete

It is now safe to uninstall the Qlik Sense services or decommission the server. When uninstalling, ensure that you select the Remove Qlik Sense certificates and data folders option.

Environment

• Qlik Sense Enterprise on Windows

While Qlik Cloud provides robust data connectivity options through the Data Movement Gateway, some organizations require additional controls to restrict access to the Qlik Cloud Talend platform itself, not only to data connections. 

While Qlik Cloud does not currently support full tenant-level access restriction via PrivateLink, it does offer:

• IP-based access control via Web Integrations
• Strong authentication and security policies
• Gateway-based PrivateLink support for data connectivity
• Cryptographically secure gateway communication

This article outlines these available options and limitations for securing tenant access at the platform level.

Content

• Does Qlik Cloud support IP Allowlist for tenant access?
• Are there network-level restrictions available for accessing the Qlik Cloud tenant?
• What are the available options for securing tenant access beyond standard authentication?
• Understanding Gateway Security Architecture
• Future Plans

Does Qlik Cloud support IP Allowlist for tenant access?

Yes. Qlik Cloud supports IP allowlisting through Web Integrations, which can be configured to restrict access to the tenant based on specific IP addresses.

See Managing web integrations for details.

Are there network-level restrictions available for accessing the Qlik Cloud tenant?

Qlik Talend Data Integration supports private connections for tenant-level access. Does Qlik Cloud support a similar, solution, such as Azure or AWS PrivateLink?

No, Qlik Cloud does not support Azure PrivateLink for tenant-level access in the same way Talend Cloud does.

• In Qlik Talend Data Integration, PrivateLink can be used to restrict access to the entire tenant.
• In Qlik Cloud, PrivateLink is supported only for data connectivity via a customer-managed gateway.
• The gateway acts as the endpoint for PrivateLink, but it does not restrict access to the Qlik Cloud web interface.
• See Support private connections in Qlik Talend Data Integration for details.

What are the available options for securing tenant access beyond standard authentication?

Qlik Cloud offers several security features for tenant access:

• Multi-Factor Authentication (MFA)
• OAuth
• Content Security Policy (CSP)
• API Keys
• Web Integrations (IP Allowlist)

See Securing the system.

Understanding Gateway Security Architecture

When using the Data Movement Gateway, Qlik Cloud ensures secure communication through a multi-step cryptographic process:

1. Key Generation & Registration:
   
   Upon installation, the gateway generates a private/public key pair and a key ID (kid). The public key and key ID are registered in Qlik Cloud by the tenant admin.
   
   
2. Secure WebSocket Establishment:
   
   
   1. The gateway initiates a TLS-secured WebSocket (WSS) connection to Qlik Cloud.
   2. During this handshake:
      
      
      • The gateway verifies QCS’s certificate.
      • Qlik Cloud verifies the JWT sent by the gateway, ensuring it includes the correct key ID and is signed with the gateway’s private key.
      • This confirms a cryptographic match to the registered public key and key ID.
        
        
3. Channel Key Derivation:
    
   • Both sides generate ECDH key pairs and exchange secrets.
   • A channel key is derived and used to encrypt all traffic over the WebSocket.
   • This key is re-derived upon reconnection or restart, ensuring session-level encryption.

This architecture ensures that all data movement operations are secure, authenticated, and encrypted end-to-end.

Future Plans

If full tenant isolation via PrivateLink is a critical requirement, please submit a feature request via Qlik Ideation.

Environment

• Qlik Cloud
• Qlik Talend Data Integration

After upgrading to Remote Engine 2.13.13, when enabling the option to execute a job from Studio on a remote engine, the process fails due to SSL and PKCS-related errors.

sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Resolution

SSL Configuration for Talend Studio to Connect with Remote Engine

1. Retain the Keystore and Truststore Passwords Generated During Installation

   During the installation of Talend Remote Engine, SSL credentials are automatically generated. To retrieve the keystore password, execute the following command:

   cat /opt/TalendRemoteEngine/bin/sysenv

   and locate the line

   TMC_ENGINE_JOB_SERVER_SSL_KEY_STORE_PASSWORD=<PASSWORD>

2. Required Keystore and Truststore Files

   The following files are necessary for secure communication between Talend Studio and the Remote Engine:

   /opt/TalendRemoteEngine/etc/keystores/jobserver-client-keystore.p12
   /opt/TalendRemoteEngine/etc/keystores/jobserver-client-truststore.p12 (Truststore file added with RE 2.13.13)

   Transfer these files to your Talend Studio workstation and store them in a dedicated folder.

3. Configure Talend Studio to Use SSL

   Edit the Studio startup configuration file, depending on your operating system:

   • For Linux (x86_64): studio/Talend-Studio-linux-gtk-x86_64.ini
   • For ARM architecture: studio/Talend-Studio-gtk-aarch64.ini  
   • For Windows: Talend-Studio-win-x86_64.ini
4. Add the following JVM options to the configuration file, and adjust the file paths and password values accordingly:

       -Dorg.talend.remote.client.ssl.force=true
       -Dorg.talend.remote.client.ssl.keyStore=path_to_keystore/jobserver-client-keystore.p12
       -Dorg.talend.remote.client.ssl.keyStoreType=PKCS12
       -Dorg.talend.remote.client.ssl.keyStorePassword=<password_from_step_1>
       -Dorg.talend.remote.client.ssl.keyPassword=<password_from_step_1><
       -Dorg.talend.remote.client.ssl.trustStore=path_to_truststore/jobserver-client-truststore.p12
       -Dorg.talend.remote.client.ssl.trustStoreType=PKCS12
       -Dorg.talend.remote.client.ssl.trustStorePassword=<password_from_step_1>
       -Dorg.talend.remote.client.ssl.disablePeerTrust=false
       -Dorg.talend.remote.client.ssl.enabled.protocols=TLSv1.2,TLSv1.3
      

Cause 

Talend Remote Engine enforces SSL communication by default, ensuring that all interactions with the engine are encrypted. If Studio does not have the appropriate certificates installed, it will be unable to establish a secure connection with the Remote Engine.

Environment

• Talend Studio 
• Talend Cloud 

The "Enable IP Allowlist" option has been enabled, and several IPs have already been added to the list to restrict access solely to those on the allowlist. However, other IPs are still able to access TMC.

Cause

To configure an IP allowlist in Talend Management Console, the user account needs to possess the Security Administrator role.
Only accounts granted the "Users - Manage" permission can bypass the IP allowlist. (This permission is encompassed within the Security Administrator role.).

1. Verify the user's role; it must NOT include a role such as Security Administrator, as this role possesses the "Users - Manage" permission, which can bypass the IP allowlist. For more details about TMC role, please read this documentation page.
2. Verify the permissions assigned to the role. If you are uncertain whether this role possesses the "Users - Manage" permission, review the role's permissions as illustrated in the screenshot below.

Resolution

Once the IP allowlist is enabled, the same user account must take one of the following actions:
Either create additional users without the "Users-Manage" permission, Or remove its own Security Administrator role.
This guarantees that the IP allowlist is effectively enforced for the account.

Consequently, IP addresses not included in the IP allowlist will be unable to connect to TMC, as illustrated below:

Related Content 

Setting up IP allowlist policy to restrict user access

Environment

• Talend Cloud 8.0.1

***Changes must be made to all Qlik servers that will not be provided with internet access.***

For servers not connected to the internet, they may be prompted with a pop-up error when browsing in the Hub or in the Data Load Editor with the following errors:

• The Hub has continuous bubbles while loading forever
• The Hub is stuck on the initial loading bar

Browser Debug tools may display the following error in the console:

Cause:

This was originally defined as an issue with the Qlik Sense DataMarket connector executable, which is cryptography signed for authenticity verification, and the .NET Framework's verification procedure when launching an executable includes checking OCSP and Certificate Revocation List information, which means fetching it online if the system doesn't have a fresh cached copy locally.

Even without the QlikData Market being in use, the solutions provided can be deployed when encountering issues with Qlik Sense Enterprise Windows servers that have no internet access. Internet access is recommended.  
 

Resolution

Only deploy one of the below options.

Option 1 will persist through upgrades, whereas Option 2 would have to be reapplied after every Sense upgrade. 

Option 1:

1. Stop all Qlik Sense services on all nodes
2. Edit C:\Windows\Microsoft.NET\Framework64\v4.0.30319\config\machine.config
   1. If there is an empty <runtime/> tag, change it to

      <runtime>     
           <generatePublisherEvidence enabled="false"/>  
      </runtime>

   2. If there is no <runtime/> tag, add the below anywhere above the closing </configuration> tag.

      <runtime>
          <generatePublisherEvidence enabled="false"/> 
      </runtime>

   3. If the <runtime> section has existing content, add generatePublisherEvidence.

      <runtime>
        <some other key="value"/>
        <generatePublisherEvidence enabled="false"/>
      </runtime>

      Example:
      
3. Save machine.config
4. Repeat on all nodes (if applicable)
5. Start services on all nodes

Node.js comes bundled with Qlik Sense Enterprise on Windows. Its version depends on the Qlik Sense released currently installed.

How do I know which version of node.js is used by Qlik Sense?

You can verify the version of any of the third-party integrations Qlik Sense makes use of by:

• Using the Qlik Sense API and calling About Service API: thirdParty: Get, which returns details including information about copyright, version, licensing, and legal notices.
• Accessing the below URL in a browser, where qlikserver.domain.local is replaced with your Qlik Sense server hostname:
  

  https://qlikserver.domain.local/api/about/v1/thirdParty

How do I upgrade my version of node.js is used by Qlik Sense?

You may want to upgrade node.js, specifically in response to a security vulnerability. To do so, upgrade Qlik Sense Enterprise on Windows. When upgrading Qlik Sense, the currently installed node.exe will be replaced with the version Qlik Sense comes bundled with at this release.

Can I install or upgrade a separately installed instance of node.js?

Installing Qlik Sense installs node.exe side-by-side in the following location: C:\Program Files\Qlik\Sense\ServiceDispatcher\Node.

If you install node.js manually it will typically be installed in C:\Program Files\nodejs and the Windows environment variable will point to this location by default (i.e. running node -v to get the version will result in providing the version of node found in C:\Program Files\nodejs).

As Qlik Sense will not register any Windows environment variable for node.js, it will not tamper with any settings affecting already installed node.js instances. Therefore it is safe to upgrade your separate instance of Node.js.

Environment

• Qlik Sense Enterprise all versions

Related Content

Third-party and middleware software integrated with Qlik Sense Enterprise on Windows 

Qlik Direct Access Gateway (DAG) is shown as disconnected. 

The Windows server's time lags behind the Qlik Cloud tenant's timezone. 

Resolution

Address the time difference by aligning the Windows server's clock. If necessary, align it to a standard NTP service. 

Cause

Misaligned time. Without alignment, Qlik Direct Access Gateway will disconnect.

Environment

• Qlik Direct Access Gateway
• Qlik Cloud Analytics

In this article, we detail the 12 steps necessary to successfully configure Qlik Sense Enterprise on Windows after an Active Directory Domain name change or moving Qlik Sense to a new domain.

Depending on how you have configured your platform, not all the steps might be applicable. Before updating any hostname in Qlik Sense, make sure that the original value is using the old domain name. In some case, you may have configured “localhost” or the server name without any reference to the domain so there is no need in these cases to perform any update.

Environment

• Qlik Sense Enterprise on Windows 

Scenario

In this scenario we are updating a three-node environment running Qlik Sense February 2021:

The domain has been changed from DOMAIN.local to DOMAIN2.local

The servers mentioned below are already part of the new domain name DOMAIN2.local and their Fully Qualified Domain Name (FQDN) is already updated as followed:

• QlikServer1.domain.local to QlikServer1.domain2.local: Central node
• QlikServer2.domain.local to QlikServer2.domain2.local: Rim node
• QlikServer3.domain.local to QlikServer3.domain2.local:  Dedicated Postgres and hosting the Qlik shared folder

All Qlik Sense services have been stopped on every node.

Step 1: Update the Postgres Configuration File

The first step is to update the postgres.conf file to listen on the correct hostname

1. Open the postgres.conf (make sure to make a copy) under
   • C:\ProgramData\Qlik\Sense\Repository\PostgreSQL\<version> (for an environment running the native Qlik Sense Repository Database)
   • C:\Program Files\PostgreSQL\<version>\data (for an environment running a dedicated PostgreSQL database)
2. Search for the parameter listen_addresses and update the hostname value if required
   
   
   
   
3. Save the file, close it and start the Qlik Sense Repository Database or PosgresSQL service depending if you are using the native PostgreSQL or a dedicated instance

Step 2: Backup your Qlik Sense site

Before doing any further changes, it is important to take a backup of your Qlik Sense Platform

• Backing up a Qlik Sense site

Step 3: Rename Server Node in QSR database

Now we update the node names in the database with the new Fully Qualified Domain Name.

1. Connect to the Qlik Sense Database using Installing and Configuring PGAdmin4 to access the PostgreSQL
2. Open the QSR Database and navigate through Schemas -> public ->Tables
3. Right-click on ServerNodeConfiguration -> View/Edit Data -> All Rows
4. Modify the hostname of each node if required
   
   
   
   
5. Save by clicking on the below icon available in the toolbar
   
   
   
   
6. Close PGAdmin

Step 4: Rename User Directory for existing users

1. Connect to the Qlik Sense Database using Installing and Configuring PGAdmin4 to access the PostgreSQL
2. Right-click on the QSR Database and select “Query Tool”
3. Run the following query
   

   UPDATE public."Users"
   SET "UserDirectory" = 'DOMAIN2'
   WHERE "UserDirectory" = 'DOMAIN';​

4. Validate the change by running the following query
   

   SELECT * FROM public."Users"​

   
   The User Directory should be updated to the new domain:
   
   
   
   
5. Close PGAdmin

Step 5: Update Service Cluster configuration

1. On the central node run the program C:\Program Files\Qlik\Sense\Repository\Util\QlikSenseUtil\QlikSenseUtil.exe and Connect to Database
   
   
   
   
2. Once connected, click on Service cluster and then OK
3. Update the FQDN with the new domain if required and press Save
   
   
   
   
4. Close QlikSenseUtil.exe

Step 6: Update the repository Connection Strings

1. On the central node run the program C:\Program Files\Qlik\Sense\Repository\Util\QlikSenseUtil\QlikSenseUtil.exe
2. Select Connection String Editor and click on Read
3. Update the FQDN with the new domain if required and press Save Value in config file encrypted
   
   
   
   
4. Close QlikSenseUtil.exe
5. Repeat the above steps on every rim node

Step 7: Update the dispatcher services connection strings

Verify if a hostname update is required

1. On the central node, open File Explorer and navigate to C:\Program Files\Qlik\Sense\Licenses and open the appsetting.json
2. Check if the parameter host contains the old domain name. If it does then you need to follow the below steps to update it otherwise you can jump to the next section

Update hostname on all Qlik Sense Dispatcher subservices

1. Search for the file called Configure-Service.ps1
   
   In Qlik Sense February, there are 8 of these files placed in different Qlik Sense Dispatcher sub-services. We need to run each of these files with a specific argument. In the previous or later version of Qlik Sense, the list presented below may need to be adapted.
   
   
2. Run the following command in PowerShell ISE as Administrator
   

   cd "C:\Program Files\Qlik\Sense\NLAppSearch\install"
   .\Configure-Service.ps1 QlikServer3.domain2.local 4432 qliksenserepository <qliksenserepository_password>
   
   cd "C:\Program Files\Qlik\Sense\AppDistributionService"
   .\Configure-Service.ps1 QlikServer3.domain2.local 4432 qliksenserepository <qliksenserepository_password>
   
   cd "C:\Program Files\Qlik\Sense\HybridDeploymentService"
   .\Configure-Service.ps1 QlikServer3.domain2.local 4432 qliksenserepository <qliksenserepository_password>
   
   cd "C:\Program Files\Qlik\Sense\Licenses"
   .\Configure-Service.ps1 QlikServer3.domain2.local 4432 qliksenserepository <qliksenserepository_password>
   
   cd "C:\Program Files\Qlik\Sense\NotifierService\install"
   .\Configure-Service.ps1 QlikServer3.domain2.local 4432 qliksenserepository <qliksenserepository_password>
   
   cd "C:\Program Files\Qlik\Sense\MobilityRegistrarService\install"
   .\Configure-Service.ps1 QlikServer3.domain2.local 4432 qliksenserepository <qliksenserepository_password>
   
   cd "C:\Program Files\Qlik\Sense\PrecedentsService\install"
   .\Configure-Service.ps1 QlikServer3.domain2.local 4432 qliksenserepository <qliksenserepository_password>
   
   cd "C:\Program Files\Qlik\Sense\DataPrepService\install"
   .\Configure-Service.ps1 QlikServer3.domain2.local 4432 qliksenserepository <qliksenserepository_password>

3. Repeat the above steps on every node (Including the verification)

Step 8: Update the Qlik Logging Service

If you are using the Qlik Logging Service;

1. Run the following command in Command Prompt:
   

   cd "C:\Program Files\Qlik\Sense\Logging"
   Qlik.Logging.Service.exe validate​

2. If you get something like:
   
   Failed to validate logging database. Database does not exist or is an invalid version.
   
   Then it probably means that the hostname needs to be updated
   
   
3. If so, run the following command in Command Prompt:
   

   cd "C:\Program Files\Qlik\Sense\Logging"
   Qlik.Logging.Service.exe update -h QlikServer3.domain2.local​

4. Once done, run the validate command again to verify that the connectivity is working
   
   
   
   
5. Repeat the above steps on every rim node

Step 9: Update the service account running the Qlik Sense services

1. On the central node, open the Windows Service Console an update each Qlik Sense services with the new domain (DO NOT START THE SERVICE AT THIS POINT)
   
   
   
   
2. Repeat the above step on every rim node

Step 10: Update the host.cfg and remove the certificate

1. On the central node login as the service account
2. Backup the Qlik Sense certificate following Backing up certificates
3. Remove the certificate you have previous backed up from the MMC
4. Make a copy of %ProgramData%\Qlik\Sense\Host.cfg and rename the copy to Host.cfg.old
   • Host.cfg contains the hostname encoded in base64. You can generate this string for the new hostname using a site such as https://www.base64encode.org/ (You may want to decode the original string to see if it contains the old domain name.
5. Open Host.cfg and replace the content with the new encoded hostname.
6. Run Windows Command Prompt as Administrator and execute the following command:
   

   "C:\Program Files\Qlik\Sense\Repository\Repository.exe" -bootstrap -iscentral -restorehostname​

7. In parallel start the Qlik Sense Dispatcher services
8. When the command has completed successfully you should see the following message in command prompt:
   
   Bootstrap mode has terminated. Press ENTER to exit..
   
   
9. Start every Qlik Sense services on the central node and try to access the QMC with https://localhost/qmc

Step 11: Distribute the certificate on the rim node(s)

1. On the rim node(s) login as the service account
2. Backup the Qlik Sense certificate following Backing up certificates
3. Remove the certificate you have previous backed up from the MMC
4. Start the Qlik Sense services
5. On the central node, open the QMC and go to Nodes
6. After a few minutes the rim node should have the status The certificates has not been installed
   
   
   
   
7. Click on Redistribute and follow the instructions to redistribute the certificates on the rim node(s)
8. After a few minutes, the services should be running
   
   

Step 12: Additional updates

User Directory Connector

If you are syncing your users with a User Directory Connector you will need to change the LDAP path to point to the new domain.

1. In the QMC -> User Directory Connector
2. Edit your existing User Directory Connector, check the LDAP Path and update if necessary
   
   

Monitoring Application

You will need to update the monitoring apps and their associated data connection to use the new Fully Qualified Domain Name

• Configuring the Monitoring apps

Data Connections password

• Part of the steps followed earlier, the certificates had to be recreated. As a result, the passwords for the existing data connection needs to be re-typed and saved for all Data Connections and User Directory Connectors that include password information.

Security Rules and Licenses rules

It is possible that you have created rules based on the User Directory. As you have changed the domain name, the user directory has also changed in Qlik Sense so you will need to update those to reflect that. 

The information in this article is provided as-is and to be used at own discretion. Depending on tool(s) used, customization(s), and/or other factors ongoing support on the solution below may not be provided by Qlik Support.

Scenario: A task with Sybase ASE as the Source and Confluent Kafka as the Destination.

Requirement: Create a new column with a unique identifier "UUID" to identify the message in Confluent Kafka.

Is there any customization in Qlik Replicate that allows the creation of a unique sequencer for each replicated record per table?

Resolution

The following transformation is provided as is. For more detailed customization assistance, post your requirement in the Qlik Replicate forum, where your knowledgeable Qlik peers and our active Support Agents can help. If you need direct assistance, contact Qlik's Consulting Services.

You can add a new column and hard-code it to a unique (random) value by using the Transform tab in Table Settings.

Example Expression Value: 

substr(lower(hex(randomblob(16))),1,8) || '-' || substr(lower(hex(randomblob(16))),9,4) || '-4' || substr(lower(hex(randomblob(16))),13,3) || '-' || substr('89ab', abs(random()) % 4 + 1, 1) || substr(lower(hex(randomblob(16))),17,3) || '-' || substr(lower(hex(randomblob(16))),21,12)

For more information on transformations, see Defining transformations for a single table/view.

Environment

• Qlik Replicate

In processing step, under Lineage, you may unable to select the "Allow Lineage collection of this task" check box to enable it when creating  or editing your task in Talend Management Console.

Resolution

To verify your Qlik Talend Cloud License Type

1. Open the Qlik Talend Management Console
2. Go to Subscriptions Tab
3. Go to License Type

Cause

The reason of "Allow Lineage collection of this task" option is not visible when creating tasks in Qlik Talend Management Console is due to the type of license currently in use. The Lineage feature is only available with the Qlik Talend Cloud Enterprise Edition or Qlik Talend Cloud Premium Edition licenses.

Related Content

For more details please find the links below

• Enabling-lineage-collection
• Subscription-options-QTC.htm

Environment

• Talend Cloud 
• Talend Studio