topic Re: How to use .PFX file to avoid website security certificate error for newsstand and web console in Qlik NPrinting

How to use .PFX file to avoid website security certificate error for newsstand and web console

shrav666 — Tue, 17 Mar 2020 20:40:38 GMT

Hi,

We do have Qlik Nprinting April 2019 application in Azure VM server running with an application in-built web server(not IIS). Due to port conflicts, we haven't installed IIS in the server. In order to avoid the error "There is a problem with the website security certificate" while launching the application web portal, we requested certificates team for SSL certificate. But they have provided us with .PFX file and told us to install in our server.

The certificate team has generated a CSR file from their end and created .PFX and shared it to us. When googled how to use .pfx file the steps were shown for IIS server, but in our case, we do not use IIS.

Could you please guide me on the steps how to use .pfx file in our Nprinting server(which do not has IIS) to avoid the website security certificate error for newsstand and web console.

Re: How to use .PFX file to avoid website security certificate error for newsstand and web console

Lech_Miszkiewicz — Wed, 31 Jul 2019 10:18:50 GMT

Hi, This is very well described in help document here: https://help.qlik.com/en-US/nprinting/June2019/Content/NPrinting/DeployingQVNprinting/Certificates.htm

In short you probably will have to get back to your certificate team and ask them for Private Key which is required. This is also clearly described in provided link.

Then you will have to convert your .pfx file to .pem file (you can use openssl to do this and you can google instructions.

Otherwise - you can provide a link i have given you to your certificate team so they can regenearte certificate in right format for you.

Re: How to use .PFX file to avoid website security certificate error for newsstand and web console

shrav666 — Wed, 31 Jul 2019 11:27:22 GMT

Hi Lech,

Thank you for your reply.

I have already gone through the link that you have provided. That was not helpful to my scenario and that doesn't answer my question.

Waiting for more relevant answers.

Re: How to use .PFX file to avoid website security certificate error for newsstand and web console

Lech_Miszkiewicz — Wed, 31 Jul 2019 11:33:23 GMT

So which part you did not understand from my link?

as i said you need certificate on pem format and private key. That makes 2 separate files. This is the only format nprinting accepts!

do you have a password to extract private key from pfx file?

without password you will not be able to proceed

Re: How to use .PFX file to avoid website security certificate error for newsstand and web console

shrav666 — Wed, 31 Jul 2019 17:22:22 GMT

Hi Lech,

I have found the below Qlik support article for the requirement am looking for. Hope it would be helpful to others with similar requirement.

https://support.qlik.com/articles/000043517-- How to convert a certificate for NPrinting to the .key and .crt files for HTTPS/SSL in the Web Console and/or the NewsStand

Before following the steps mentioned in the above article, I have installed OpenSSL following the steps mentioned in Qlik help portal. https://help.qlik.com/en-US/nprinting/April2019/Content/NPrinting/DeployingQVNprinting/Installing-SSL.htm

I have followed all the steps from 1 to 6 in https://support.qlik.com/articles/000043517 except 3 as while extracting .key file from .pfx, it didn't ask me for a passphrase. All the steps went well and after restarting web engine, web console and newsstand URLs both using IP address and DNS are not working. so strange!!

Below are the log files. Could you please suggest a solution

Thank you in advance

Re: How to use .PFX file to avoid website security certificate error for newsstand and web console

Lech_Miszkiewicz — Wed, 31 Jul 2019 23:42:23 GMT

Hi,

You said: "I have followed all the steps from 1 to 6 in https://support.qlik.com/articles/000043517 except 3...."

that indicates to me that in your .pfx file there was no key included. When creating .pfx file your "certificate guys" need to include in it private key and they need to give you password so then you can extract it using the steps you have mentioned. If thats a case you need to get back to your certificates guys and ask them for certificate with the key and password.

This is what i meant in my second answer to your question when I mentioned that you will need a password...

btw.

all other commands you mentioned are correct. I was just doing the exact same thing yesterday and these are cmd's i used (assuming that my certificate was called NPrinting.pfx):

openssl pkcs12 -in NPrinting.pfx -nocerts -out NPrinting.key
openssl pkcs12 -in NPrinting.pfx -clcerts -nokeys -out NPrinting.crt
openssl rsa -in NPrinting.key -out NPrinting-decrypted.key

i then renamed NPrinting-decrypted.key to NPrinting.key and used it with NPrinting.crt

Re: How to use .PFX file to avoid website security certificate error for newsstand and web console

Lech_Miszkiewicz — Wed, 31 Jul 2019 23:43:30 GMT

Btw.

Look at web server logs when working on it - they idicate issue with key....

Re: How to use .PFX file to avoid website security certificate error for newsstand and web console

shrav666 — Thu, 01 Aug 2019 12:20:39 GMT

Hi Lech,

Thank you for investing your time. 🙂

I have approached our certificate team and waiting for their reply. But I want to tell you that our certificate team has provided us with a password for extracting .pfx file and I have applied it in step 1 and 2, even still you feel there was something wrong with the certificates.

And want to you if your Nprinting links worked well without any issues after following all the steps in the provided link.

Thank you

Re: How to use .PFX file to avoid website security certificate error for newsstand and web console

Lech_Miszkiewicz — Thu, 01 Aug 2019 12:45:45 GMT

I am not saying that your certificate is wrong.

All what i am saying is that it is either not extracted properly or not installed properly.

If you have password and you are sure that certificate has private key in it you can use my 3 commands and do all the job.

After applying certificates and using fully qualified domain names to access nprinting console and news stand i had trusted connection. In web server logs there were no errors!

Re: How to use .PFX file to avoid website security certificate error for newsstand and web console

shrav666 — Fri, 02 Aug 2019 10:29:20 GMT

Hi Lech,

I have performed all the steps again. Now there is no issue while performing the steps and it asked for passphrase this time. There are no errors in log files too after restarting the web engine. Everything went well.

But when launched the portal I saw the certificate error again. Reason found was there was no root and intermediate certificates and got the root and intermediate certificates from the team and installed.

Certificate error is solved finally. But we have observed 30sec - 45sec delay in loading the portal after performing this certification task. Before it used to takes just 2sec to load the page.

Appreciate if you can provide any suggestions for the performance issue.

Thank you.

Re: How to use .PFX file to avoid website security certificate error for newsstand and web console

Lech_Miszkiewicz — Sun, 04 Aug 2019 23:18:03 GMT

First thing first - great that you managed to get certificate working. I do not want to be picky but i said and gave you link ( https://help.qlik.com/en-US/nprinting/June2019/Content/NPrinting/DeployingQVNprinting/Managing-cert.htm ) what criteria certificate needs to meet. It would already help with the fact that you did not have root and intermediate certificate...

So for the sake of others chasing up the same problem - please read carefully requirements on help.qlik.com - screeenshot below:

Regarding your question about delay in loading portal. I did not observe anything like this on any environments I've had setup. First thing i would do is to inspect what is happening behind the scenes when opening admin or news stand pages ("F12" in chrome ). Observe what takes time to load...

On another note. I do not think this is a topic we should discuss in this thread as it is not related to your initial question and i would suggest opening new ticket for this particular issue with well described scenario etc...