Creation of certificates fails

[ManuelRühl]

While the installation of February 2021 Version no certificates where created.
The folder 'C:\ProgramData\Qlik\Sense\Repository\Exported Certificates\.Local Certificates\' does not exist.
So the Repository Database Service starts and stops immediately.

The VM was completely fresh (Server 2016), the user has local admin rights. I tried reinstallation with Sophos AntiVirus deactivated.

I tried to create the certificates using these articles but thr bootstrap command fails:

https://community.qlik.com/t5/Support-Knowledge-Base/How-to-recreate-or-just-delete-certificates-in-...

https://community.qlik.com/t5/Support-Knowledge-Base/Qlik-Sense-Hub-and-Management-Console-down-Boot...

The bootstrap command fails with the message "keyset not found" (see attachment).

Maybe it is a Domain Policy problem?

Thanks in advance for help!

[Gencho]

Hello @ManuelRühl  

I have found this:

https://community.qlik.com/t5/Knowledge-Base/Qlik-Sense-Hub-and-Management-Console-down-Bootstrap-fa...

Please check it and let me know if is helpful

Regards

[ManuelRühl]

Thanks @Gencho 

I mentioned this link in my initial description. But setting a registry entry does not work for me. 😐

But in the article is written: "This issue is caused by access issues when attempting to access/recreate the certificates and/or other GPOs that affect certificates."

I hope that someone here can tell me which GPOs are critical.

[Bastien_Laugiero]

Hello!

To verify if this is GPO related you could try to install Qlik Sense as a local user instead of a domain user. This way you will at least bypass all the User based policies. 

I do not know any particular GPO that could cause that so you may need to try a step by step approach by unlinking GPOs to the Qlik Sense user until you find the one. 

Hope this helps!

[ManuelRühl]

@Bastien_Laugiero 

I tried to install with a local admin user without any GPOs, same error. 😕

Even the Nov2020-Version produces the certificate error. I think something is wrong with the VM.

[Bastien_Laugiero]

Thank you for the feedback. Yes it could definitely.

Do you have the opportunity to test on another VM?

[ManuelRühl · Accepted solution]

We've found the mistake:

Last year we rolled out the actually untrustworthy (because it was created and signed) certificate for the host name to all systems as a trustworthy certificate via the group policy. The aim behind this was to ensure that the browser used did not issue a certificate warning. Apparently it was precisely the rollout of this one certificate that prevented the installation of a new certificate.

So the server is running now. The only thing we have to do is to add a SEPARATE certificate with this instruction to get a access via HTTPS: https://community.qlik.com/t5/Support-Updates-Blog/Qlik-Sense-Hub-and-QMC-with-a-custom-SSL-certific...

thanks for all suggestions!

I mark this post as correct answer for all users facing the same problem in the future.