article How to enable Data Encryption Key Rotation in Qlik Sense Enterprise on Windows in Official Support Articles

How to enable Data Encryption Key Rotation in Qlik Sense Enterprise on Windows

ToniKautto — Tue, 09 Feb 2021 12:57:37 GMT

Qlik Sense encrypts app (.QVF) and data (.QVD) files at time of write to disk. This means that changes to the encryption certificate is not reflected in encrypted files until next time the file is written to disk by the Qlik Sense Engine.

QVF file is encrypted when successfully reloaded, either manually or through a reload task.
QVD file is encrypted when it is successfully generated through a STORE command in a reload script.

Completely replacing encryption certificate requires that all encrypted files are re-written to disk with the new certificate. Any file that remains encrypted with old certificate, can only be opened by Qlik Sense Engine if the old certificate still remains in the certificate store.

If encryption certificate is not available in certificate store, the encrypted QVF or QVD file will not be possible to open by Qlik Sense Engine and any user access to the file will be denied.

Environment:

September 2019 and later

Resolution:

A successful key-encryption key (KEK) rotation requires that both the new and old certificate are available in certificate store until key change has been applied on all encrypted files.

Import the new certificate to Windows certificate store on all Qlik Sense Engine nodes
Configure Qlik Sense to use the new certificate for encryption
Re-write all encrypted QVF an QVD files
- Save QVF files manually or run reload task
- Regenerate QVD files through STORE command in app reload
Backup old encryption certificate (in case it is needed later)
Remove old encryption certificate from Windows certificate store
Validate that all encrypted files can be accessed

Re: How to enable Data Encryption Key Rotation in Qlik Sense Enterprise on Windows

athiksir — Tue, 20 Jul 2021 10:46:27 GMT

I've try to encrypt QVF but it's not work, QVF files still can open in other server even in Qliksense Desktop. but QVD files it work.

Re: How to enable Data Encryption Key Rotation in Qlik Sense Enterprise on Windows

Sonja_Bauernfeind — Thu, 22 Jul 2021 12:24:24 GMT

Hello @athiksir

I would recommend getting in touch with our Support for this. This may require additional investigation.

All the best,

Sonja

Re: How to enable Data Encryption Key Rotation in Qlik Sense Enterprise on Windows

ayoubtarmouniartpdev — Thu, 10 Apr 2025 23:09:59 GMT

Hello @Sonja_Bauernfeind We changed the service account, and while everything works fine now, we had previously enabled data encryption on QVF and QVD files using the old account. As a result, all apps now return a 503 error when opened. To fix it, we must open each app without data, reload the data, and reopen it. I'm looking for a way to automate this process for all apps at once instead of doing it manually one by one.

Re: How to enable Data Encryption Key Rotation in Qlik Sense Enterprise on Windows

Sonja_Bauernfeind — Fri, 11 Apr 2025 06:39:16 GMT

Hello @ayoubtarmouniartpdev

I recommend posting your requirement in the Management and Governance forum, where your knowledgeable Qlik peers and our active Support agents can better assist you.

All the best,
Sonja

article How to enable Data Encryption Key Rotation in Qlik Sense Enterprise on Windows in Official Support Articles

How to enable Data Encryption Key Rotation in Qlik Sense Enterprise on Windows

Environment:

Resolution:

Related Content:

Re: How to enable Data Encryption Key Rotation in Qlik Sense Enterprise on Windows

Re: How to enable Data Encryption Key Rotation in Qlik Sense Enterprise on Windows

Re: How to enable Data Encryption Key Rotation in Qlik Sense Enterprise on Windows

Re: How to enable Data Encryption Key Rotation in Qlik Sense Enterprise on Windows