topic Re: Installing SSL certificate on Sense server in Management & Governance

Installing SSL certificate on Sense server

Anonymous — Fri, 05 Dec 2014 16:46:23 GMT

Hi all,

Yesterday I attempted to install a real, signed certificate on our Sense server as detailed here:

https://help.qlik.com/sense/en-US/online/Subsystems/Qlik_Management_Console_help/Content/ServerUserGuide/SUG_ConfiguringSecurity_Deployment_AddingProxyCert.htm

Unfortunately, after that was done, I couldn't get in via either SSL or regular HTTP. When I attempted to get in via SSL I would get a server not responding error, and when attempting via HTTP I was asked for my credentials three times before being presented with a blank white screen. This was when connecting to either hub or qmc.

I'm not looking for how to get in and fix it - We're just going to restore from backup and start over. I just want to know how to do it right!

Do I need to remove the spaces from the thumbprint when I paste it into the QMC? Anything else that might not be obvious to someone (me) who isn't really much of a Windows admin?

Thanks!

Re: Installing SSL certificate on Sense server

korsikov — Tue, 09 Dec 2014 08:04:25 GMT

How I did it.

Received from domain CA certificate on the server. If not necessary to, I will describe how to do this.

further open the properties of the certificate, tab "details" option "Thumbprint"

and copied value as is, with spaces.

Open QMC in my server

https://fly/qmc/proxies

Edit Proxy, check Security and paste value in "SSL browser sertificate thumbprint" with space.

Restart Qlik Sense Web Server.

enjoy!

Re: Installing SSL certificate on Sense server

edwinwitvoet — Sat, 13 Dec 2014 07:16:15 GMT

I exactly followed the process above for installing a server SSL certificate (both with entering the thumbprint with and without spaces). After saving the thumbprint, connection is lost and I cannot connect to QMC anymore.

Firefox : "The connection was interrupted"

- How to rollback?

- How to find out what actually goes wrong?

Appreciate any suggestions

Re: Installing SSL certificate on Sense server

edwinwitvoet — Mon, 15 Dec 2014 19:30:31 GMT

OK, I got my SSL certificate running by

1. stopping the qlik repository service,

2. installing my certificates on the windows server

3. entering the SSL browser certificate thumbprint in the proxy (with the whitespaces)

4. removing the qlik certificates

5. restart the qlik repository service (which re-installs the qlik certificates again)

Re: Installing SSL certificate on Sense server

jcampbell — Tue, 16 Dec 2014 20:28:37 GMT

I had the same problem, the QMC was busted, but following your steps, removing the qlik certs didn't help. I had to roll back a VM snapshot. It shouldn't be this difficult to get a cert working. Any other suggestions? Thanks.

Re: Installing SSL certificate on Sense server

edwinwitvoet — Tue, 30 Dec 2014 07:45:54 GMT

I worked through the same problems with QMC getting busted when adding the thumbprint.

Turned out that my certificate was not installed properly.

I also had to reinstall the VM snapshot before I could get back into the QMC. Qlik Sense should be more robust to that indeed.

Re: Installing SSL certificate on Sense server

Anonymous — Fri, 14 Oct 2016 09:37:38 GMT

Hi Edwin,

I am facing the same issue you were facing; however, I was not able to set the thumb print when the service it stopped. Any ideas how to get the Qlik Sense to recognize the SSL certificate?

Thanks!

Re: Installing SSL certificate on Sense server

Anonymous — Wed, 30 Nov 2016 18:22:09 GMT

I ended up getting things working again by running the query below directly in the Postgres database that Qlik Sense is using behind the scenes (note that I only had one server and there was only one row in the table).

update public."ProxyServiceSettings" set "SslBrowserCertificateThumbprint" = null

Re: Installing SSL certificate on Sense server

Anonymous — Wed, 30 Nov 2016 18:25:43 GMT

In what way was your certificate not installed properly? I'm having the same problem but not sure what to do differently.

Re: Installing SSL certificate on Sense server

Mon, 19 Dec 2016 17:25:03 GMT

Hi Alex,

I tried your solution without success, editing the value in the DB. Could you please give me some more details to restablish Qlik? Is there any other actions missing?

Thanks

Re: Installing SSL certificate on Sense server

Anonymous — Mon, 19 Dec 2016 17:40:00 GMT

I think the only thing I didn't mention was that I restarted the server.

Re: Installing SSL certificate on Sense server

melghandour89 — Sun, 12 Feb 2017 10:17:11 GMT

Stop Qlik Sense Repository Service (this will also stop the other services)
Applying an SSL Certificate to server

to apply an SSL Certificate to a Qlik Sense server

Launch the MMC
When the MMC opens go to File|Add/Remove Snap-in.
Click on the Certificates snap-in on the left side list box and click the add button.
Choose Computer account and click Next.
Leave Local computer selected and click Finish.
Click OK to go back to the MMC.

Then restart the server and running all qlik services and try again for more details please check this link
Hope it Work

Re: Installing SSL certificate on Sense server

Faizoel — Tue, 28 Mar 2017 06:14:03 GMT

This way also worked for me, without any errors or issues. Qlik Sense 3.1 SR2.

Thanks!

Re: Installing SSL certificate on Sense server

melghandour89 — Tue, 28 Mar 2017 07:59:44 GMT

Nice work

Sent from myMail for iOS

Tuesday, March 28, 2017, 9:14 AM +0300 from Faizoel Kasiemkhan <qcwebmaster@qlikview.com>:

Re: Installing SSL certificate on Sense server

Wed, 16 Aug 2017 14:22:08 GMT

I already installed the certificates, but the site still show the insecure legend when I tried to open from outside.

I saw the logs and I see this:

No private key found for certificate 'CN=xx.xxxxxxxxxxxx.com, OU=Domain Control Validated' (xxxxxxxxxxxxxxx)c3b9033e-xxxx-xxxx-xxxx-xxxxxxxxxxx

5 20170815T172713.730-0300 WARN XXXX Security.Proxy.Qlik.Sense.Communication.Security.CertSetup 7 d0297779-xxxx-xxxx-xxxx-b51b06a8db33

XXXX\QSADM Couldn't find a valid ssl certificate with thumbprint xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx 0x d0297779-ea18-4521-870f-b51b06a8db33

6 20170815T172713.730-0300 WARN XXXX Security.Proxy.Qlik.Sense.Communication.Security.CertSetup 7 ea1a39dd-b87c-43c0-ad8c-492f9e14d305

XXXX\QSADM Reverting to default Qlik Sense SSLCertificate ea1a39dd-b87c-43c0-ad8c-492f9e14d305

7 20170815T172713.730-0300 INFO XXXX Security.Proxy.Qlik.Sense.Communication.Security.CertSetup 7 2fee8c35-1aaa-4f0f-9cac-a354854910cd

XXXX\QSADM Set certificate 'CN=xxxx.xxxxx.LOCAL' (8FA4393ECD334653A281886E4C3FA3D302A97F35) as SSL certificate presented to browser

Thats mean the certificated doesnt work and restored to the default one?

Cheers

PS: I already added the site in the whitelist

Re: Installing SSL certificate on Sense server

igorgois_ — Mon, 06 Nov 2017 15:56:16 GMT

facing the same problem here.

this link https://support.aginic.com/support/solutions/articles/14000031148-applying-an-ssl-certificate-to-qlik-sense says on step 9 "(the pfx file)". I only have a .crt file from go daddy and the certificate import worked.

and when i try to access using https I get:

NET::ERR_CERT_AUTHORITY_INVALID

Subject: pontagrossa

Issuer: pontagrossa-CA

Expires on: 17 de jul de 2027

Current date: 6 de nov de 2017

But this is the old certificate and not the new one

any clue?

thanks in advance

Re: Installing SSL certificate on Sense server

francisco_valle — Fri, 29 Dec 2017 22:51:12 GMT

Hi,

Try using the certreq tool from CMD:

certreq -accept example_com.cer

Regards.

Re: Installing SSL certificate on Sense server

Anonymous — Tue, 30 Jan 2018 20:00:58 GMT

Did you ever figure this out? I'm having the same problem now, thumbprint updated in Qlik QMC but restarted everything and still browsers are using the old certificate.

Re: Installing SSL certificate on Sense server

igorgois_ — Wed, 31 Jan 2018 11:50:08 GMT

Yes,

look the steps i followed at:

install ssl certificate from go daddy in qlik sense

Re: Installing SSL certificate on Sense server

Anonymous — Wed, 31 Jan 2018 16:46:44 GMT

Hmm I followed those steps. It's like Qlik doesn't care that I changed the thumbprint because no matter what I do it still points to the old certificate.