topic Re: Sense unable to locate a ssl certificate in Management & Governance

Sense unable to locate a ssl certificate

Clever_Anjos — Thu, 02 Mar 2017 14:45:32 GMT

i´m not beeing able to make my Sense box use a valid SSL certificate

Error message Couldn't find a valid ssl certificate with thumbprint

Steps taken so far:

Trace log

Sequence#	Level	Logger	Thread	ServiceUser	Message
1	INFO	Security.Proxy.Qlik.Sense.Common.Security.Cryptography.LoggingDigester	1	WIN-8JETLOID025\qsapp	Setting crypto key for log file secure signing: success
2	INFO	Security.Proxy.Qlik.Sense.Common.Security.Cryptography.SecretsKey	9	WIN-8JETLOID025\qsapp	retrieving symmetric key from cert: success
3	INFO	Security.Proxy.Qlik.Sense.Common.Security.Cryptography.CryptoKey	9	WIN-8JETLOID025\qsapp	setting crypto key: success
4	WARN	Security.Proxy.Qlik.Sense.Communication.Security.CertSetup	9	WIN-8JETLOID025\qsapp	No private key found for certificate 'CN=sense.meubi.com.br, OU=PositiveSSL, OU=Domain Control Validated' (1F284854608E80E245D7B640849BB03FE819048F)
5	WARN	Security.Proxy.Qlik.Sense.Communication.Security.CertSetup	9	WIN-8JETLOID025\qsapp	Couldn't find a valid ssl certificate with thumbprint 1f 28 48 54 60 8e 80 e2 45 d7 b6 40 84 9b b0 3f e8 19 04 8f
6	WARN	Security.Proxy.Qlik.Sense.Communication.Security.CertSetup	9	WIN-8JETLOID025\qsapp	Reverting to default Qlik Sense SSLCertificate
	INFO	Security.Proxy.Qlik.Sense.Communication.Security.CertSetup	9	WIN-8JETLOID025\qsapp	Set certificate 'CN=WIN-8JETLOID025' (047E90CF18BF749E1EF503E674C2B90960D04E51) as SSL certificate presented to browser

jaisoni_trp — Thu, 02 Mar 2017 15:22:39 GMT

I would check couple of things here:

a) Does the certificate have private key i.e. do you see a key icon in certificate?

b) Double check if its stored on correct location.

jaisoni_trp — Thu, 02 Mar 2017 15:24:02 GMT

Per Qlik:

The definition of an invalid certificate is as follows:

The operating system considers the certificate to be too old or the certificate chain is incorrect or incomplete.
The Qlik Sense certificate extension (OID “1.3.6.1.5.5.7.13.3”) is missing or does not reflect the location of the certificate:
- Current User/Personal certificate location: Client
- Local Machine/Personal certificate location: Server
- Local Machine/Trusted Root certificate location: Root
- Current User/Trusted Root certificate location: Root
The server, client, and root certificates on the central node do not have a private key that the operating system allows them to access.
The server and client certificates are not signed by the root certificate on the machine.

Clever_Anjos — Thu, 02 Mar 2017 15:30:01 GMT

>>a) Does the certificate have private key i.e. do you see a key icon in certificate?

Where should I find that icon?

jaisoni_trp — Thu, 02 Mar 2017 15:45:40 GMT

In MMC on the certificate.

Clever_Anjos — Fri, 03 Mar 2017 11:07:19 GMT

Here?

I don´t have that icon.

Could you kindly guide me how to create/obtain it?

Clever_Anjos — Fri, 15 Sep 2017 18:11:25 GMT

Closing the topic.

The certificate was issued without the private key.

Clever_Anjos — Fri, 15 Sep 2017 18:12:04 GMT

a) Does the certificate have private key i.e. do you see a key icon in certificate?

Morteza561 — Sat, 11 Mar 2023 16:56:16 GMT

I had a weird problem about this error and I've finally resovled it!

This was what I was getting in Security_Proxy Log:

Current version of .NET does not support the private key algorithm for certificate

I've got my SSL from Let's Encrypt Certbot and the problem was (according to the documentation) key file's encryption algorythm!

I've came up with the idea of changing the algorithm by adding "--key-type rsa" to the end of my command and it worked like charm!

full command:

certbot certonly --manual --preferred-challenges=dns --email xxx@yyy.com --server https://acme-v02.api.letsencrypt.org/directory --agree-tos -d *.example.com --key-type rsa