topic Re: Error while generating CSR in Management & Governance

Error while generating CSR

reshma_km — Tue, 27 Feb 2018 16:31:38 GMT

Hi,

This is a question regarding Generating Certificate Signing Requests for Trusted Certificates

I downloaded the openssl from the below link as mentioned in the comments:

https://slproweb.com/products/Win32OpenSSL.htm

The file I installed was the highlighted one below.

I followed the steps to create CSR, but after pasting the command from Digicert, I got a warning and nothing was generated.

I don't see any openssl.conf file in my server. Of course I understand that I installed a different file than the one mentioned in the document (as the link in the document was not working).

Could you please help me?

Re: Error while generating CSR

JustinDallas — Tue, 27 Feb 2018 20:09:40 GMT

It looks like your command was designed to run on a Linux system

/usr/local/ssl/openssl.cnf is a Linux path.

Re: Error while generating CSR

reshma_km — Tue, 27 Feb 2018 20:14:17 GMT

Oh... Thanks for the input.

So now what can I do to correct this? Did I install the wrong file?

Re: Error while generating CSR

JustinDallas — Tue, 27 Feb 2018 21:20:28 GMT

I'm not sure what your next step should be. When I've generated my CSRs to get my SSL keys, I didn't have to use another program. Maybe there is a directory/file setting that you have to set, and it's using the Linux path (/usr/local...) as the default?

Re: Error while generating CSR

reshma_km — Tue, 27 Feb 2018 21:54:40 GMT

Ok Justin.

Could you please tell me how did you generate the CSR?

Re: Error while generating CSR

JustinDallas — Wed, 28 Feb 2018 14:49:59 GMT

This following website is what I used to generate the CSR. I then took that CSR, and gave it to the other IT folks who then sent it to the domain host (GoDaddy I think). The host sent back the certificate which I then installed.

How to generate Certificate Signing Request using Microsoft Management Console (MMC) on Windows 2012 — Technote Article …

Re: Error while generating CSR

reshma_km — Wed, 28 Feb 2018 14:55:19 GMT

Thanks a lot.

This is not specific to IIS, right? I am planning to get a verisign certificate.

Re: Error while generating CSR

JustinDallas — Wed, 28 Feb 2018 15:09:18 GMT

No, this has nothing to do with IIS. It has to do with the Windows certstore which is completely different from IIS. I'm not sure about how Verisign does their thing, but even if they give you a cert, you can still install it and then use it in Qlik.

Re: Error while generating CSR

reshma_km — Wed, 28 Feb 2018 15:15:02 GMT

Ok. Thank you.

Re: Error while generating CSR

reshma_km — Wed, 28 Feb 2018 15:22:57 GMT

So, after getting the certificate, the procedure to install them is as described in https://help.qlik.com/en-US/sense/November2017/Subsystems/ManagementConsole/Content/change-to-signed-server-proxy-certif…

Is that right?

Re: Error while generating CSR

JustinDallas — Wed, 28 Feb 2018 15:24:38 GMT

Yes.

Re: Error while generating CSR

reshma_km — Wed, 28 Feb 2018 15:43:38 GMT

Ok. Let me try this method then.

Re: Error while generating CSR

reshma_km — Wed, 28 Feb 2018 21:49:30 GMT

Hi Justin,

I was able to create a CSR and got an Entrust certificate. I imported it to MMC and configured proxy in QMC. But I still get the browser error. Did you encounter any problems while importing? Anything to be careful about, from your experience?

However, I didn't cross check the below points from help site. I will check them once.

The certificate itself has to contain a private key regardless of the Qlik Sense version. You can verify if a key is present by reviewing the certificate in the Microsoft Management Console (MMC). You should see a confirmation message: "You have a private key that corresponds to this certificate."

You must make sure that the certificate is available for the service account that is running the Qlik Sense services. The best way to do this is to run the MMC as the service account and see if the certificate is visible in Personal > Certificates. If you are running services with local system, you can use a tool such as Psexec to run the MMC as local system and check that the certificate is available.

Re: Error while generating CSR

JustinDallas — Thu, 01 Mar 2018 14:16:30 GMT

Make sure you import it into the right account (User, Computer, Service), I think Service is the one you want. If you have a CSR and you get a key, you shouldn't have to select where to import it, it will be able to match up where you generated the CSR from with the key you've been given.

Re: Error while generating CSR

reshma_km — Thu, 01 Mar 2018 15:21:35 GMT

Hi,

Its working for me now. I had 3 certificates(server, root, intermediate) and I imported the wrong one. I imported the correct certificate (server) and configured proxy in QMC. The browser errors are gone now. Thanks a lot for your timely help

Re: Error while generating CSR

JustinDallas — Thu, 01 Mar 2018 16:13:02 GMT

You're welcome. I'm usually not so generous, but I remember how it took me a whole day to get my certificate stuff working. As you know now, it's not difficult, it's just that there are lots of times where you can do the wrong thing, like generating the CSR under the wrong account.