It appears that the internal CA root certificate (subject: CN=server-name-CA, which is used for internal authentication even if a different certificate is used for port 443) is not a valid CA, because it lacks the CA flag (the X509v3 Basic Constraints extension). It's obviously possible to install as a trusted root CA in Windows' certificate store, but other software refuses to recognize certificates signed by it as valid, even if you tell such software to trust it.
Is this a known bug? Is it possible to replace the root certificate with a manually constructed one? Will Qlik Sense use it as long as it has the right subject and the private key is available or if the thumbprint is updated in some obscure place (more obscure than the thumbprint for the public web interface certificate)? Or has it even been fixed recently (but certificates will still have to be replaced in that case)?
