article How to recreate or just delete certificates in Qlik Sense - No access to QMC or Hub in Official Support Articles

How to recreate or just delete certificates in Qlik Sense - No access to QMC or Hub

Bjorn_Wedbratt — Thu, 21 Aug 2025 06:16:16 GMT

There may be several different symptoms associated with a need to regenerate and redistribute certificates;

After installing, renewing, or changing a third-party certificate for use with Qlik Sense the Qlik Management Console (QMC) and Hub may become inaccessible leading to Page Cannot Be Displayed error.

This article does not cover the use of a 3rd party certificate for end user Hub access, but the certificates used for communication between the Sense services. For recommendation on how to use a 3rd party certificate for end user access, see How to: Change the certificate used by the Qlik Sense Proxy to a custom third party certificate
In the Qlik Sense Proxy trace logs, the last line may be indicating waiting for certificates to be installed or similar. In addition, even though Proxy service remains running, port 443 (by default) will fail to bind and start listening for requests.
Qlik Sense may sometimes fail to create the correct certificates during installation if there are old/unused certificates left from a previous installation. Also, certs can become corrupted, or newly installed certificates configured to be used may not be compatible. See Qlik Sense: Compatibility information for third-party SSL certificates and Requirements for configuring Qlik Sense with SSL.

Do not perform the below steps in a production environment, without first doing a backup of the existing certificates. Certificates are being used to encrypt information in the QRS database, such as connection strings. By recreating certificates, you may lose information in your current setup.
By removing the old/bad certificates, and restarting the Qlik Sense Repository Service (QRS), the correct certificates can be recreated by the service. If trying to remove certs, only the removal steps need to be followed.

The instructions are to be carried out on the Qlik Sense Central Node. In the case of a multi-node deployment, verify which node is the central node before continuing.

Open Qlik Sense Management Console (QMC)
Navigate to Nodes section
Add the column Central Node column through Column selector

If the current central node role is held by the failover, you need to fail the role back to the original central node by shutting down all the nodes (this implies downtime). Then start the original central node, reissue the certificates on it with this article, and when the central node is working apply the article Rim node not communicating with central node - certificates not installed correctly on each Rim node.

Step by Step instructions:

Test all data connections after the certificates are regenerated. It is likely that data connections with passwords will fail. This is because passwords are saved in the repository database with encryption. That encryption is based on a hash from the certificates. When the Qlik Sense signed certificates are regenerated, this hash is no longer valid, and the saved data connection passwords can not be decrypted. The customer must re-enter the passwords in each data connection and save. See article: Repository System Log Shows Error "Not possible to decrypt encrypted string in database"

Log on to the Central node using the Qlik Service Account and navigate to the 'Services' and to the Qlik Services.
Stop the Qlik Repository Service and Qlik Dispatcher Service, but verify that the postgresql-64-12 or Qlik Sense Repository Database continues to run.
Open Microsoft Management Console (MMC).

Important: Execute the MMC as the account configured to run the services (using Run as a different user [Ctrl-Shift & Right click on the exe to see option]... )
Add the following snap-ins for Certificates:
- My user account
- Local Computer account
In Certificates (Local Computer) > Trusted Root Certification Authorities > Certificates, delete the Self-Signed certificates created by Qlik Sense, issued by HOSTNAME.domain-CA*

*Where HOSTNAME is the machine name of the server in question and domain is the domain of the server.
So for example, QlikServer1 is the computer hostname and the domain is domain.local, the certificate will be issued by QlikServer1.domain.local-CA
In Certificates (Local Computer) > Personal > Certificates, delete the Self-Signed certificate issued by HOSTNAME.domain-CA
In Certificates > Current User > Personal > Certificates, delete the Self-Signed certificate named QlikClient
Go to the folder C:\ProgramData\Qlik\Sense\Repository, delete the folder 'Exported Certificates'
Run this command from an elevated (admin) command prompt to create new certificates:

"C:\Program Files\Qlik\Sense\Repository\Repository.exe" -bootstrap -iscentral -restorehostname

Note: If the script doesn't get to "Bootstrap mode has terminated. Press ENTER to exit.." and gets stuck at "[INFO] Entering main startup phase.." start the "Qlik Sense dispatcher service" and it will get to the end)
Verify the new certificates have been created by REFRESHING the screen for each certificate location, and then start the rest of the Qlik Sense services. In addition, verify that duplicate or multiple certificates were not created (rarely occurs). If so, the article will need to be followed again by starting with the deletion of the certificates.

There is no need to perform a full reinstall to propagate new certificates. Certificates are created by the QRS automatically if not found during the service startup process.

For Qlik Sense multi-cloud deployment (September 2020 or later):

The steps in this section must be performed after recreating certificates as described above.

Start Qlik Sense Repository Database service on CENTRAL NODE, or PostgreSQL Server service if running a dedicated instance of PostgreSQL database server.
Using pgAdmin tool or any other database client, connect to SenseServices database. (IMPORTANT: the below query needs to be executed on the SenseServices DB)
Execute following query against SenseServices database:
DROP TABLE IF EXISTS hybrid_deployment_service.mt_doc_asymmetrickeysencrypt CASCADE;
Navigate to Deployments page of Multi-cloud Setup Console (MSC).
Delete and re-add any existing deployments by following the steps mentioned in Distributing apps from Qlik Sense Enterprise on Windows to Qlik Sense Enterprise SaaS and Distributing apps to Qlik Sense Enterprise on Kubernetes.

Node.js certificates

After the certificates have been recreated and then redistributed to all of the rim nodes, the node.js certificates stored locally on the central and all rim nodes also need to be recreated. Follow the below steps to perform this action:

Stop all Qlik Sense services
In Windows File Explorer, navigate to %ProgramData%\Qlik\Sense\Repository\Exported_certificates
Back up the Local certificates directory and then delete it
Restart the Qlik Sense services

Test all data connections after the certificates are rebuilt. It is likely that data connections with passwords will fail. This is because passwords are saved in the repository database with encryption. That encryption is based on a hash from the certs. When the Qlik Sense self-signed cert is rebuilt, this hash is no longer valid, and so the saved data connection passwords will fail. The customer must re-enter the passwords in each data connection and save. See article: Repository System Log Shows Error "Not possible to decrypt encrypted string in database"

Self Signed Certificates:

Notice if using an official Signed Server Certificate from a trusted Certificate Authority

The certificate information will also be in the QMC, under Proxies, with the Certificate thumbprint listed. If trying to merely remove all aspects of certs, this will need to be removed as well.

Go to Proxies
Select your Proxy and click Edit
In the right pane, select Security
Scroll down and locate "SSL browser certificate thumbprint" in the Security section to locate the thumprint info.

If the Central Node repository service hanging in the logs:

Open C:\ProgramData\Qlik\Sense\Log\Repository\Trace
Look for this Example "API service initialized with 1501 available methods". This is Central Node.
If you see this Example "API service initialized with 2 available methods". This is a Rim node.
For Central Node you should see as an example ""API service initialized with 1501 available methods".
Running this command "C:\Program Files\Qlik\Sense\Repository\Repository.exe" -bootstrap -iscentral -restorehostname will resolved this issue.

If the above does not work, see Qlik Sense Enterprise Hub and Qlik Management Console (QMC) down - bootstrap fails with "Newly created client certificate not valid; root certificate can't sign new certificates"

Re: How to recreate or just delete certificates in Qlik Sense - No access to QMC or Hub

QFabian — Thu, 08 Jul 2021 00:27:35 GMT

thanks @Bjorn_Wedbratt , another good tips

Re: How to recreate or just delete certificates in Qlik Sense - No access to QMC or Hub

diagonjope — Thu, 28 Jul 2022 12:58:53 GMT

Hi @Bjorn_Wedbratt ,

First of all, thanks for these instructions.

I've noticed that the instructions in the text description add the snap-ins for both Current User and Local Computer, but the video instructions only uses certificates from the Current User section. Is this just enough? Are the certificates in the Local Computer section just copies of the ones in the Current User section that are copied during the certificate regeneration process?

Please advise - also, please tag my user name so that I get a msg when you reply.

Cheers,

++José

Re: How to recreate or just delete certificates in Qlik Sense - No access to QMC or Hub

Sonja_Bauernfeind — Thu, 28 Jul 2022 13:19:52 GMT

Hello @diagonjope

Let me look into this for you. I will get back to you once I received clarification and gave this a test.

All the best,
Sonja

Re: How to recreate or just delete certificates in Qlik Sense - No access to QMC or Hub

Sonja_Bauernfeind — Mon, 01 Aug 2022 11:48:33 GMT

Hello @diagonjope

We have confirmed that you're required to delete the certificates in both stores. Current User and Local Computer.

All the best,
Sonja

Re: How to recreate or just delete certificates in Qlik Sense - No access to QMC or Hub

diagonjope — Mon, 01 Aug 2022 13:01:11 GMT

Thank you Sonja!

Re: How to recreate or just delete certificates in Qlik Sense - No access to QMC or Hub

Purushothaman — Wed, 07 Feb 2024 06:37:05 GMT

Hi @Sonja_Bauernfeind,

For stopping services during bootstrap, should the Qlik Sense Service Dispatcher be stopped or continue to run?

Thank you!

Re: How to recreate or just delete certificates in Qlik Sense - No access to QMC or Hub

Sonja_Bauernfeind — Wed, 07 Feb 2024 15:14:16 GMT

Hello @Purushothaman

The note we have regarding the Dispatcher is: If the script doesn't get to "Bootstrap mode has terminated. Press ENTER to exit.." and gets stuck at "[INFO] Entering main startup phase.." start the "Qlik Sense dispatcher service" and it will get to the end.

I hope this helps!

Otherwise, the service should be stopped.

All the best,
Sonja

Re: How to recreate or just delete certificates in Qlik Sense - No access to QMC or Hub

stevejoyce — Tue, 20 Feb 2024 15:09:52 GMT

In my qlik site, the issued by computer of the root certificate is not one of the central node candidates, i assume at some point it was and configured out.

Am I safe to perform these steps on the current active central node? or do i need to re-elevate the old computer back as a failover candidate and failover to it?

Re: How to recreate or just delete certificates in Qlik Sense - No access to QMC or Hub

stevejoyce — Tue, 20 Feb 2024 17:32:34 GMT

@Sonja_Bauernfeind - If you can please take a look at my last post, greatly appreciated.

Re: How to recreate or just delete certificates in Qlik Sense - No access to QMC or Hub

Sonja_Bauernfeind — Thu, 22 Feb 2024 08:11:12 GMT

Hello @stevejoyce

There is currently not enough information available for Qlik to be able to respond accurately.

Please gather the following information and post directly in the Deployment and Management forum, where our active support agents and Qlik peers can assist:

Setup information (central node, rim nodes)
Versions of Qlik Sense used
Details about the scenario (which node is your central node, details about the certificates having been issued)
Issues you are seeing and which you are looking to resolve or what you are otherwise attempting to correct or achieve
Possible errors

All the best,
Sonja

Re: How to recreate or just delete certificates in Qlik Sense - No access to QMC or Hub

qlikthomas1 — Mon, 04 Mar 2024 07:32:01 GMT

I Tried This above New Solution the certificates in the personal got created new but I couldn't see qlik certificate in "Trusted Root Certification Authorities"
@Sonja_Bauernfeind
@Bjorn_Wedbratt

Re: How to recreate or just delete certificates in Qlik Sense - No access to QMC or Hub

Sonja_Bauernfeind — Mon, 04 Mar 2024 12:53:47 GMT

Hello @qlikthomas1

Verify that all services were correctly restarted. If the certificate still has not been created, review the Qlik Sense Repository Trace logs for possible errors: C:\ProgramData\Qlik\Sense\Log\Repository\Trace

All the best,
Sonja

Re: How to recreate or just delete certificates in Qlik Sense - No access to QMC or Hub

RanOuerg — Thu, 06 Jun 2024 19:54:41 GMT

Hello @Sonja_Bauernfeind @Bjorn_Wedbratt

I'm planning an upgrade from Qlik sense August 2022 to Qlik sense February 2024

I have an issue: i don't have the password for my qlik sense certificate so i can't do the backup (Export)

Is there any way to solve this issue ?

If i delete the certificate QlikClient and i run the command to generate automatically is it safe and will it solve my issue ?

I'm looking for a solution so i can back up my qlik sense environment

Thank you in advance.

Re: How to recreate or just delete certificates in Qlik Sense - No access to QMC or Hub

ChristianMoltz — Wed, 12 Mar 2025 14:15:01 GMT

Hi @Bjorn_Wedbratt

I do not reach the end "Bootstrap mode has terminated. Press ENTER to exit..", also not after starting the "Qlik Sense dispatcher service. The certificates are created. The hub and qmc are still not reachable

The issue not being able to reach the hub or qmc occured after restart of the server after the issue came up the Qlik license server is not reachable. (Everything had been working for quite som time)

Thanks

Re: How to recreate or just delete certificates in Qlik Sense - No access to QMC or Hub

rwunderlich — Wed, 12 Mar 2025 23:29:07 GMT

@ChristianMoltz This has happened to me several times on my development machine. I've only been able to fix it by uninstalling/installing Qlik Sense. Let me know if you find a better resolution.

-Rob