Installing SSL certificate on Sense server

[Anonymous]

Hi all,

Yesterday I attempted to install a real, signed certificate on our Sense server as detailed here:

https://help.qlik.com/sense/en-US/online/Subsystems/Qlik_Management_Console_help/Content/ServerUserG...

Unfortunately, after that was done, I couldn't get in via either SSL or regular HTTP. When I attempted to get in via SSL I would get a server not responding error, and when attempting via HTTP I was asked for my credentials three times before being presented with a blank white screen. This was when connecting to either hub or qmc.

I'm not looking for how to get in and fix it - We're just going to restore from backup and start over. I just want to know how to do it right!

Do I need to remove the spaces from the thumbprint when I paste it into the QMC? Anything else that might not be obvious to someone (me) who isn't really much of a Windows admin?

Thanks!

[Anonymous]

I think the only thing I didn't mention was that I restarted the server.

[melghandour89]

1. Stop Qlik Sense Repository Service (this will also stop the other services)
2. Applying an SSL Certificate to server

to apply an SSL Certificate to a Qlik Sense server

1. Launch the MMC
2. When the MMC opens go to File|Add/Remove Snap-in.
3. Click on the Certificates snap-in on the left side list box and click the add button.
4. Choose Computer account and click Next.
5. Leave Local computer selected and click Finish.
6. Click OK to go back to the MMC.

Then restart the server and running all qlik services and try again for more details please check this link
Hope it Work

[Faizoel]

This way also worked for me, without any errors or issues. Qlik Sense 3.1 SR2.

Thanks!

[melghandour89]

Nice work

Sent from myMail for iOS

Tuesday, March 28, 2017, 9:14 AM +0300 from Faizoel Kasiemkhan <qcwebmaster@qlikview.com>:

>

[#6]

I already installed the certificates, but the site still show the insecure legend when I tried to open from outside.

I saw the logs and I see this:

No private key found for certificate 'CN=xx.xxxxxxxxxxxx.com, OU=Domain Control Validated' (xxxxxxxxxxxxxxx)c3b9033e-xxxx-xxxx-xxxx-xxxxxxxxxxx

5 20170815T172713.730-0300 WARN XXXX Security.Proxy.Qlik.Sense.Communication.Security.CertSetup 7 d0297779-xxxx-xxxx-xxxx-b51b06a8db33

XXXX\QSADM Couldn't find a valid ssl certificate with thumbprint xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx xx 0x d0297779-ea18-4521-870f-b51b06a8db33

6 20170815T172713.730-0300 WARN XXXX Security.Proxy.Qlik.Sense.Communication.Security.CertSetup 7 ea1a39dd-b87c-43c0-ad8c-492f9e14d305

XXXX\QSADM Reverting to default Qlik Sense SSLCertificate ea1a39dd-b87c-43c0-ad8c-492f9e14d305

7 20170815T172713.730-0300 INFO XXXX Security.Proxy.Qlik.Sense.Communication.Security.CertSetup 7 2fee8c35-1aaa-4f0f-9cac-a354854910cd

XXXX\QSADM Set certificate 'CN=xxxx.xxxxx.LOCAL' (8FA4393ECD334653A281886E4C3FA3D302A97F35) as SSL certificate presented to browser

Thats mean the certificated doesnt work and restored to the default one?

Cheers

PS: I already added the site in the whitelist

[igorgois_]

facing the same problem here.

this link https://support.aginic.com/support/solutions/articles/14000031148-applying-an-ssl-certificate-to-qli... says on step 9 "(the pfx file)". I only have a .crt file from go daddy and the certificate import worked.

and when i try to access using https I get:

NET::ERR_CERT_AUTHORITY_INVALID

Subject: pontagrossa

Issuer: pontagrossa-CA

Expires on: 17 de jul de 2027

Current date: 6 de nov de 2017

But this is the old certificate and not the new one

any clue?

thanks in advance

[francisco_valle]

Hi,

Try using the certreq tool from CMD:

certreq -accept example_com.cer

Regards.

[Anonymous]

Did you ever figure this out?  I'm having the same problem now, thumbprint updated in Qlik QMC but restarted everything and still browsers are using the old certificate.

[igorgois_]

Yes,

look the steps i followed at:

install ssl certificate from go daddy in qlik sense

[Anonymous]

Hmm I followed those steps.  It's like Qlik doesn't care that I changed the thumbprint because no matter what I do it still points to the old certificate.