topic Re: NPrinting Feb 2024 SR2 "Installed certificates are valid to connect to Qlik Sense" validation error in Qlik NPrinting

NPrinting Feb 2024 SR2 "Installed certificates are valid to connect to Qlik Sense" validation error

Lech_Miszkiewicz — Wed, 24 Jul 2024 02:21:24 GMT

Hi @Frank_S @Ruggero_Piccoli @Gianluca_Perin

This time I am facing error which I am unable to resolve. I am helping my friends to setup and configure their NPrinting environment. Environment description:

Single Domain
- Qlik Sense server (Qlik Sense November 2023) running on Windows 2022 Server Datacentre
- NPrinting server (NPrinting Feb 2024 SR2 - there was no lable for that version)
  - NPrinting Server and Engine is installed on single machine

I guided them step by step with everything while watching and instructing them via teams regarding all steps and configuration. Now we have issue when trying to create connection to Qlik Sense app. When running validation we get error (red cross) on "Installed Nprinting certificates are not valid to connect to Qlik Sense" check.

The app we are trying to connect to is a simple app with Ctrl+0+0 script and single straight table chart - created only for testing, but in fact NPrinting is not even able to read the app since it has connectivity issue due to this certificate problem.

As far as I can tell we have everything done by the book and all other environments I have setup worked without issues in the past.

We have added NPrinting engine service account to root admins in Qlik Sense. That service account is a domain account belonging to the same domain as Qlik Sense and NPrinting.

NPrinting February 2024 SR2 is installed and activated on dedicated server running on:

Edition Windows Server 2022 Datacenter
Version 21H2
Installed on ‎05.‎07.‎2024
OS build 20348.2582

NPrinting Engine is active and Online.

NPrinitng is installed on server in domain "xxx.local". That is the same domain which Qlik Sense runs in. It runs on domain account which meets all requirements from:

https://help.qlik.com/en-US/nprinting/February2024/Content/NPrinting/DeployingQVNprinting/User-accou...

We have verified all requirements for server and engine:

We have enabled TLS 1.2 on Qlik Sense and NPrinting servers. We have checked and verified with "telnet" that port communication is opened on 443,4242,4243 and 4747 to Qlik Sense. We also checked required cipher suits as per https://help.qlik.com/en-US/nprinting/February2024/Content/NPrinting/DeployingQVNprinting/TLS-cipher....

We have followed all steps required to export Qlik Sense certificates and installed them on NPritning machine. We paid close attention to the hostname required when exporting certificates. We have tried doing this multiple times. Also we checked that the certificate file was "Unlocked" on the NPrintign server

We have disabled "Apply Qlik Sense server certificate validation" in ADMIN-->SETTINGS-->TASK--> checkbox "Apply Qlik Sense server certificate validation". We did that few times (enabled/disabled) to make sure it didnt stall.

We also tried following below steps: https://help.qlik.com/en-US/nprinting/February2024/Content/NPrinting/Troubleshooting/NP-wont-read-QS...

We have reviewed also this post: https://community.qlik.com/t5/Qlik-NPrinting/Installed-Nprinting-certificates-are-not-valid-to-connect-to/td-p/1970731 and follow all steps from there with no success.

It is first time ever I am facing this issue when installing and configuring NPrinting and I cannot see anything else to check with support articles,help site or community regarding this problem.

My collegues opened support case regarding this (Qlik Support Team Your case number is : 00294396) so if there is any confidential information required I will be happy to provide it there. That case includes also logs.

I wonder what I missed - hope you guys can help.

cheers

Re: NPrinting Feb 2024 SR2 "Installed certificates are valid to connect to Qlik Sense" validation error

Ruggero_Piccoli — Wed, 24 Jul 2024 07:33:42 GMT

Hi @Lech_Miszkiewicz ,

It could be a Messaging service issue. Check https://help.qlik.com/en-US/nprinting/February2024/Content/NPrinting/Troubleshooting/Qlik-NPrinting-Messaging-Service-startup-connection-problems.htm.

Best Regards,

Ruggero

Re: NPrinting Feb 2024 SR2 "Installed certificates are valid to connect to Qlik Sense" validation error

Lech_Miszkiewicz — Wed, 24 Jul 2024 08:06:29 GMT

Hi @Ruggero_Piccoli - ok - I am on it - will get back to you once I test your suggestions.

thanks

Re: NPrinting Feb 2024 SR2 "Installed certificates are valid to connect to Qlik Sense" validation error

Lech_Miszkiewicz — Wed, 24 Jul 2024 10:07:32 GMT

Hi @Ruggero_Piccoli,

Messaging service seemed to be working fine. Regardless we stiI went through all the steps from the article but that did not help.

thanks

Lech

Re: NPrinting Feb 2024 SR2 "Installed certificates are valid to connect to Qlik Sense" validation error

Frank_S — Thu, 25 Jul 2024 14:11:50 GMT

@Lech_Miszkiewicz I will also have a look at the case directly and support from there. Cheers!

In the meantime, I helped another customer virtually identical issue recently with the following:

ensuring that you connect directly from the NPrinting connection to the Qlik Sense 'Virtual Proxy' associated 'proxy' node via the computer name (FQDN) of this node
do not connect from the NP connection to any alias or Network Load balanced address associated with/redirected to the QS virtual proxy.
Ensure that virtual proxy node uses window 'ticket' (not saml nor any other auth method)

Kind regards....

Re: NPrinting Feb 2024 SR2 "Installed certificates are valid to connect to Qlik Sense" validation error

Frank_S — Thu, 25 Jul 2024 15:19:16 GMT

Also this as this is commonly - and admittedly - easily missed (must be done with the right user account or it will not help).

https://help.qlik.com/en-US/nprinting/February2024/Content/NPrinting/Troubleshooting/NP-wont-read-QS-certificates.htm

Updating your intranet security settings

Certain intranet settings may block connections to Qlik Sense servers. If a server is not responding, you should change the intranet settings.

Do the following:

Log into the Qlik NPrinting Server using the Qlik NPrinting Domain User Service Account credentials that run the Qlik NPrinting scheduler service.
Open the Windows Control Panel.
Go to Internet Options.
Click Change security settings.
Click the Security tab.
Select Local Intranet.
Click the Sites button, click the Advanced button.
Add all of the Qlik Sense Proxy Server computer names to the list, including the domain name: https://sense_proxy_computer_name.domain_name.
Click Close.
Click Ok twice to close the Internet Properties window.
Repeat this process on each Qlik NPrinting Engine running the Qlik NPrinting Engine service, using the Windows Qlik NPrinting Engine services administrator.

Re: NPrinting Feb 2024 SR2 "Installed certificates are valid to connect to Qlik Sense" validation error

Lech_Miszkiewicz — Fri, 26 Jul 2024 00:48:02 GMT

Thanks Frank - I will get back to you once we test it (We will consider both your comments). I really hope this works this time.

thanks

Lech

Re: NPrinting Feb 2024 SR2 "Installed certificates are valid to connect to Qlik Sense" validation error

Lech_Miszkiewicz — Fri, 26 Jul 2024 09:27:04 GMT

Hi @Frank_S

Those settings were managed by GPO. For testing we excluded it from GPO and did the changes as per your instructions but still it did not help. I guess our best bet at the moment is to get someone from Qlik to have a session with client so they could check everything again, collect whatever information they need and take it from there.

cheers

Lech

Re: NPrinting Feb 2024 SR2 "Installed certificates are valid to connect to Qlik Sense" validation error

Frank_S — Fri, 26 Jul 2024 22:33:38 GMT

@Lech_Miszkiewicz

I'm sure you already did this but just to be doubly sure, please do ensure that when you log onto the NP server as the NP scheduler service account, it should appear as similar to the image below.

If the local intranet websites are blank again, then you need to go back in, re-enter the QS Virtual actual computer name (add this too) and FQDN server address(s).

Group Policy needs to be blocked from overwriting these fields for the NP scheduler service user account on the NP server.

Also I agree, yes please to continue via the case and I will monitor the progress from there. We discussed this case in our call yesterday and (in addition to myself) one of our Seniors in your time zone is also now monitoring and supporting your support engineer.

Cheers...fs

Re: NPrinting Feb 2024 SR2 "Installed certificates are valid to connect to Qlik Sense" validation error

Lech_Miszkiewicz — Thu, 29 Aug 2024 09:04:41 GMT

Hi @Frank_S @Ruggero_Piccoli

Ridiculous scenario:

Qlik NPrinting service account
- during installation was added as root admin to Qlik Sense
- was active in AD and working
- when creating Qlik Sense app was working
- but with time (when UDC synced it with AD) it got status "Inactive" due to AD filter on UDC connector

Because the NPrinting connection validation error was constantly stopping at proxy certificates we were mislead by this process and focuesed on wrong things.

The only reason we found out about the issue was when I suggested using NPrinting service account to login to QMC and then it turned out it was Inactive:

Conclusion:

yes - it is one of the main requirements to have NPrinting service account to be root admin
yes - we checked above at the time when we added that account manually:
- open Qlik Sense Hub --> User appeared in user list in QMC --> we set its role to Root Admin and it was active at the time
the misleading error caused us to look in wrong direction and focused on wrong things
there was no log indicating the root issue
having a log stating exactly what it said in web browser when trying to access QMC ("Your account is inactive.....") would be a 1 minute troubleshooting job.

I have seen a lot of different scenarios and normally I would be able to identify issue quickly, however in this case given clients very secure environmnet and lack of ability to "play" alone with it, it was hard to spot the obvious.

Anyway - lesson learned - the validate connection process not necessarily produces comprehensive guidence to how to resolve the issue.

cheers

Re: NPrinting Feb 2024 SR2 "Installed certificates are valid to connect to Qlik Sense" validation error

Frank_S — Thu, 29 Aug 2024 14:22:17 GMT

https://community.qlik.com/t5/Official-Support-Articles/How-to-avoid-the-RootAdmin-s-from-becoming-inactive/ta-p/1715558
@Leah Not exactly clear how the account became inactive. However this article "might" help prevent the account from becoming inactive going forward.
And yes, we have seen this behavior occasionally and yes we also test by the same technique (ie logging in as the NP service account to ensure it can access the resources it needs to such as network shares, the NP server from the Qlik Sense server visa versa and etc.

Great job as always!