topic Re: wrong ssl certificate used for login page in Management & Governance

wrong ssl certificate used for login page

Gysbert_Wassenaar — Mon, 23 Oct 2017 07:06:59 GMT

Hello,

I have qlik sense server that's configured with a 3rd party ssl certificate. After logging in that certificate is used and the browser is happy with the trustworthy certificate.

However when logging in the form login page (https://server.domain.com:4244/form/?targetId=xyz....etc‌) uses the self-signed certificatate instead of the proper certificate. This is not nice, because now users see warnings in the browser that this an insecure site.

On another site everything works correctly and I don't see differences in how the proxy and virtual proxies are configured. Any help and hints are appreciated.

Re: wrong ssl certificate used for login page

kaushiknsolanki — Mon, 23 Oct 2017 07:15:29 GMT

Hi,

Not sure but couple of checks.

1. DNS entry.

2. Host name mapping defined in hosts file of windows server.

Regards,

Kaushik Solanki

Re: wrong ssl certificate used for login page

Gysbert_Wassenaar — Mon, 23 Oct 2017 07:25:33 GMT

Nope, that's not it. The domain name is fine. It's only on the login page that Qlik Sense uses its own self-signed certificate. Thanks anyway.

Re: wrong ssl certificate used for login page

kaushiknsolanki — Mon, 23 Oct 2017 07:49:08 GMT

What I understand is when a request is made from browser to Qlik Sense, it checks for the Proxy SSL certificate if it is not available or access is not allowed then it will use the self signed certificate.

What you think on this.

If this is the case then Help site says below.

When editing a proxy certificate as a user without admin privileges, you need to run the repository in bootstrap mode before the changes take effect.

Regards,

Kaushik Solanki

Re: wrong ssl certificate used for login page

Gysbert_Wassenaar — Mon, 23 Oct 2017 08:11:33 GMT

Yeah ok. But the QS proxy does have access to the SSL certificate. After logging in it uses that certificate and the browser is happy. It's only on the login page that the self-signed certificate is used. It's like it uses the right certificate for port 443 but still uses the self-signed certificate for port 4244. And this does not happen on another QS site we have. There the self-signed certificate is never presented to the users browser.

Re: wrong ssl certificate used for login page

simon_minifie — Mon, 23 Oct 2017 08:38:08 GMT

Hi Gysbert,

The SSL certificate is bound to port 443 which is why it's presented there.

If you want the same for the form login page, you will also need to bind it to 4244. You are specifying the port number in the URL, so you can't expect it to use the certificate bound to port 443.

best regards,

Simon

Re: wrong ssl certificate used for login page

Gysbert_Wassenaar — Mon, 23 Oct 2017 08:54:25 GMT

So why does it work on my other qlik sense site?

Re: wrong ssl certificate used for login page

simon_minifie — Mon, 23 Oct 2017 09:09:01 GMT

Actually, that's a very good point. It should automatically bind to both ports.

Open up a command prompt on the server and have a look at the 'netsh http show sslcert'

The same certificate hash should be bound to 443 and 4244

Re: wrong ssl certificate used for login page

Gysbert_Wassenaar — Mon, 23 Oct 2017 11:06:56 GMT

That's what I thought. But I when I checked the the self-signed certificate was (and is) bound to port 4244.

Re: wrong ssl certificate used for login page

simon_minifie — Mon, 23 Oct 2017 11:22:33 GMT

Ok, have you tried removing that binding and applying the signed certificate to it?

Re: wrong ssl certificate used for login page

Gysbert_Wassenaar — Mon, 23 Oct 2017 13:07:55 GMT

That seems to have done the trick. Thanks!

It would be nice to know why it was necessary, but if it keeps working I can live with it.

Re: wrong ssl certificate used for login page

simon_minifie — Mon, 23 Oct 2017 14:57:23 GMT

Glad we got there 🙂

Yes, is odd that it happened. I presume there was an error during the removal of the self-signed certificate. Would have been nice to see an error somewhere.

thanks,

Simon

Re: wrong ssl certificate used for login page

Gysbert_Wassenaar — Tue, 24 Oct 2017 05:55:21 GMT

Yeah, that could be it. The self-signed certificate was replaced after I'd added the 3rd party certificate.

Thanks for the help!

Re: wrong ssl certificate used for login page

rzenere_avvale — Thu, 19 Apr 2018 13:40:38 GMT

Thanks Simon,

the same issue happened to me and your post solved the issue.

Still many thanks,

Riccardo