topic Re: QMS API - Using Certificates in QlikView

QMS API - Using Certificates

Mon, 26 Jan 2026 18:19:17 GMT

Hi,

I am trying to use the example as found in the SDK Docs and attempting to connect to the QMS API but keep getting the error:

> The HTTP request was forbidden with client authentication scheme 'Anonymous'.

I am trying to connect to the QMS API on a developer machine which is on a different network. I installed the certificates on the developer machine by exporting on the Qlikview server and importing on the dev box. Any ideas how I can connect to the QMS API remotely?

Re: QMS API - Using Certificates

ergustafsson — Tue, 22 Jul 2014 12:38:30 GMT

Hi Chris,

As stated in the Server Reference Manual, you also need to be a member of the "QlikView Management API" security group, see page 59: https://d1cf4w4kkla6tb.cloudfront.net/qlikview/11.20/12451/QlikView%20Server%20Reference%20Manual_ENG.pdf . Also ensure the ports are open, so easiest way to test that it works is by doing it locally first.

Regards,

Erik

Re: QMS API - Using Certificates

Tue, 22 Jul 2014 23:23:37 GMT

Hi Erik,

This fails locally as well as remotely. Also the user running Qlikview is in all groups.

-Chris

Re: QMS API - Using Certificates

ergustafsson — Wed, 23 Jul 2014 07:08:00 GMT

Hi Chris,

If this fails locally then you might want to start investigating on that end. Ensure the user you are running with is running as an administrator (Right click on the program and select "Run as an administrator") and is a member of "QlikView Administrators", Local "Administrators" and "QlikView Management API" groups.

I would recommend to test with the QMS API Client first, part of the power tools. Then you can test commands too. It is an unsupported product but it is quite neat. Accessible at Power Tools 1.2 for QlikView . Ensure that the service address matches your QMC, that the Service Version is correct and that you automatically retrieve new service key if needed.

Regards,

Erik

Re: QMS API - Using Certificates

Wed, 23 Jul 2014 08:18:07 GMT

Hi Erik,

Funny you should say that.. tried using QMSClient on the local server today and got this error when trying to get a service key:

System.ServiceModel.Security.SecurityNegotiationException: Could not establish secure channel for SSL/TLS with authority 'qvapp1:4799'. ---> System.Net.WebException: The request was aborted: Could not create SSL/TLS secure channel.

Re: Re: QMS API - Using Certificates

ergustafsson — Wed, 23 Jul 2014 08:36:39 GMT

Hello again,

Can you access the service URL locally? http://localhost:4799/QMS/Service. If it doesn't work, might want to start in that end. Have you enabled SSL on the QMC? See C:\Program Files\QlikView\Management Service\QVManagementService.exe.config:

	<!-- Use HTTPS instead of HTTP for SSL-encrypted communication. You must configure a certificate for this to work -->
	<add key="UseHTTPS" value="false"/>

This setting is by default set to false, and if changed to true and you are using SSL communication, it might be the reason why it fails. Try temporarily changing it, and restart the QMC.

Regards,

Erik

Re: Re: QMS API - Using Certificates

Wed, 23 Jul 2014 08:44:51 GMT

Hi Eric,

Unfortunately no I am unable to get the http only https, in fact all the services throughout qlikview seem to be only accessible through https (and Qlikview itself seems to be working). Checking the configurations, all of them are set as <add key="UseHTTPS" value="false"/>. Setting to true and restarting the management service unfortunately doesn't change the error.

As a bit more information, its a base/clean installation on a freshly installed OS.

Re: Re: QMS API - Using Certificates

ergustafsson — Wed, 23 Jul 2014 10:52:49 GMT

Hi Chris,

Do you build trust with certificates? Check the same .config file, but instead check:

	<!-- Set to true to enable regular windows authentication between services;
	set to false to enable certificates and SSL in communication between services -->
	<add key="UseWinAuthentication" value="true"/>

If set to false, then that is the reason why. Enabling communication with trust between services, should still make a local QMS API client work, if trying to connect to https://localhost:4799/QMS/Service . Notice the S after HTTP.

Regards,

Erik

Re: Re: QMS API - Using Certificates

Wed, 23 Jul 2014 23:29:22 GMT

Hi Erik,

Yes we use certificate trust, so WinAuthentication is set to false.. Our systems don't utilize active directory. I can connect to https://localhost:4799/QMS/Service and it says within the browser that the all the certificates are valid. QV itself is working perfectly. Its all very strange. Any other points are appreciated.

Re: Re: Re: QMS API - Using Certificates

ergustafsson — Thu, 24 Jul 2014 08:30:19 GMT

Hi Chris,

When using the QMS API Client, try https://localhost:4799/QMS/Service when connecting, notice the S. If it is not working, you might need to bind the certificates for it to pick up. Not sure if the QMS API Client supports HTTPS. Either way, I know that for instance when using certificates and sending EDX triggers, there are some configuration steps. I can imagine API calls would be similar to a certain extent. See attached, that is the closest I can get you I believe. Otherwise try disabling the whole certificate trust and confirm that is where the issue lies.

Regards,

Erik

Re: Re: Re: QMS API - Using Certificates

Fri, 25 Jul 2014 05:54:22 GMT

Hi Erik,

This morning I signed in as the user which runs the Qlikview Services. I noticed that the user didn't have the certificates stored in the personal section. I imported them and it works perfectly. Unfortunately no other users (even though they have the certificates are working).

Remotely (so a computer on a different network) still receives the same error. Do you know if the Qlikview Services are designed to work across multiple works?

Re: Re: Re: QMS API - Using Certificates

ergustafsson — Fri, 25 Jul 2014 06:38:34 GMT

Hi Chris,

The other users needs to be in the suggested security groups mentioned above. Yes, the QlikView Services should work with API tools across networks, especially within the same domain. Across domains you might encounter some permissions issue outside of QlikView, but if it works in general then it works for QlikView too. Ensure that the ports are open and connectable. See QlikView Ports for more information.

Regards,

Erik

Re: Re: Re: QMS API - Using Certificates

Fri, 25 Jul 2014 06:52:16 GMT

Hi Erik,

The Service Account and Administrator user are in identical groups and settings. Its on the local server box so surely that should affect it? All ports are open and still the same result. Is there a recommended method to export the certificates from one user and import to another?

-Chris

Re: Re: Re: QMS API - Using Certificates

ergustafsson — Fri, 25 Jul 2014 06:55:07 GMT

Hi Chris,

If it works for those account and they are in those groups locally, then that would explain why it works for them. Add other service/user accounts in those groups in order to get this to work, and export/import the private certificates on the other machine where you want it to work. You need a certificate to get inside of the "trusted zone" of the QMC and the other service. Without it, you have no possibility to communicate. The certificates are used to build trust.

Re: QMS API - Using Certificates

Tue, 29 Jul 2014 08:19:42 GMT

Hi Erik,

Managed to get a solution:

I deleted all certificates.. Rebooted a number of times and allowed Qlikview to recreate all the certificates. It appeared when I did the original export of certificates under the *administrator* account I should of exported it under the user that runs the Qlikview services. To resolve the problem:

Signed in to the server desktop as the user who runs the services (in > this case "QlikviewUser")
Load up MMC.exe :: Certificates :: Local Computer (not personal or service)
Exported all 3 Certificates with Private Key (Private key isn't available under any other user). If you export them as another user it'll export them successful but its not including the private key.. So it has to be signed in as the user who runs the Qlikview Services and under Local Computer. I did try giving the Administrator user access to the private key under Local Computer but this didn't resolve the problem.
Sign in as the Administrator User or whatever user you want to use the API under to the Desktop
Go to MMC :: Certificates :: Personal
Import all 3 certificates.
Success

This is how I got it to work under other users on the local server box. Previously, all the certificates were marked as valid and were installed following the Qlikview manual line by line. It seems as if this "functionality" hasn't been documented very well.

To get it working remotely, I added the Qlikview Server's name in my hostfile and added the certificates to the Local Computer and Personal times. After this it resolved itsself.

Only challenge yet is how to configure the API in Qlikview to use a FQDN instead of a computer hostname.

Re: QMS API - Using Certificates

stephencredmond — Thu, 20 Nov 2014 11:22:21 GMT

Where can one get his hands on QVCertTool?

Re: QMS API - Using Certificates

gdevarashettyhf — Tue, 04 Oct 2016 18:54:03 GMT

Hi Stephen,

I thought you know everything 🙂 . I happen to look for this Tool as I need to use EDX commandline using certificates. Did you get hold of this QVCertTool?

Anyone else? Appreciate your help.

Ganesh