NPrinting Verification process does not capture certificate FQDN mismatch in turn resulting in GRPC errors or not able to reload metadata

Frank_S — Tue, 11 May 2021 17:33:10 GMT

GRPC and CEF error logging issues discovered in the Task Execution and NPrinting Engine log and while attempting to preview NPrinting reports in the NPrinting Template Editor or Executing NPrinting Publish Tasks and or On Demand reports
Result is NPrinting reports containing Qlik Sense images fail to preview normally via the NPrinting Template Editor and fail to execute normally when run as an NPrinting Publish Task or On Demand report
The following NPrinting connection verification error may be present: "x - Sense Engine on port 4747 is reachable"
Metadata reload may fail with "...has reached error status" registered in the logs.
When attempting to connect to the Qlik Sense hub a 403 forbidden error generated

Environment discovered:

Versions Affected:

None of the Qlik Sense charts used with NPrinting reporting use 'chart assistance'
All charts used with NPrinting reported are supported for use with NPrinting and/or are configured as per specification See "References" below

Identify a possible FQDN certificate mismatch:

On the NPrinting server:

On the Qlik Sense server:

Export the Qlik Sense certificates via the QS QMC certificate export menu option
View the certificate properties checking the FQDN path
ie: mycertQSserver1.newdomain.com

Result: If the FQDNs do not match, you have a FQDN certificate mismatch

NP server: certificate originally imported from Qlik Sense server: mycertQSserver1.domain1.com
Current Qlik Sense certificate exported: mycertQSserver1.newdomain.com

How to resolve the issue if a certificate mismatch can be identified

ALL pending and or open Task Executions in the NP web console via the Admin>Executions page
ALL pending and or open On-Demand request executions in the NP web console via the Admin>On-Demand requests page

Disable all Publish Tasks. No Task or On-Demand executions should be in the process of execution during the certificate export and import process.

Next:

Using the QS QMC 'Certificates' interface, re-export the Qlik Sense certificates using the following attributes
- no password and
- 'include secret key' check box enabled and
- Insert FQDN (Fully Qualified Domain name path) of the NPrinting server (avoid using an IP address to ensure future DNS resolution flexibility) ie: myNPserver1.domain.com

Export the certificates
Copy the newly exported certificates to the NPrinting server
Log onto the NPrinting server as the NPrinting service account
Run the NPrinting certificate installer program which will import the certificate files to there respective certificate stores on the NPrinting server
Click 'Yes' to remove the previously installed certificates (note if the certificate FQDN path is a mismatch with the recently exported QS certificates)
Restart all five NPrinting services

Finally:

Previewing your NPrinting reports should work as expected
Enable Publish Tasks as needed. These should now execute as expected
On Demand reporting may now proceed normally
If issue persists, check out the suggested time out values as per the following article "Advanced troubleshooting of the GRPC and or CEF Error Issues" have been applied however the GRPC errors persist and report generation which contain Qlik Sense images fails.

The Qlik Sense server certificates may have been recently regenerated/recreated thus requiring those newly re-generated certificates to be exported for use with NPrinting then re-imported into NPrinting as mentioned in the resolution section of this article
The trusted root authority associated with the originally exported certificates has recently been changed and the NPrinting certificates have not been updated accordingly
The mismatch is not currently identified by the NPrinting connection verification process. NOTE: An improvement request has been made with R&D to provide a clearer 'verification' check in future versions of NPrinting

Reference:

Creating visualizations using Insight Advisor chart suggestions
Enabling export of your visualization extension
Using Qlik Sense third-party extensions