Qlik Sense migration and upgrade with new service account

[J_Mulholland]

We are upgrading our Qlik Sense Sept 2020 Enterprise environments to new servers and upgrading to Qlik Sense Feb 2022.  We also need to use new service accounts for the Qlik services on the new servers.  Is it best to use the old service accounts for the software install and restore on the new servers  then switch to the new service accounts.   Or can we use the new service accounts for the software install and restore on the new servers straight away?

[Jaroslav_Stsetinin]

Hello, you can use a new service account on a new machine, but bear in mind that repository db restore will keep the old SA name and you need to check and change SA name in the QMC. Please check the following article section "Change the service account" starting step 3:

https://community.qlik.com/t5/Knowledge/Qlik-Sense-Service-Account-requirements-and-how-to-change-th...

3. Access the QMC to validate functionality, preferably as a previously configured RootAdmin
4. Access the Data Connections section of the QMC
5. Toggle the User ID field and change the data connections used by the License and Operations Monitor apps to use the new user ID and password:

6. Add the RootAdmin role to the new service account*
QMC > Users
Filter on the new UserID > Edit
Add RootAdmin role

*If this account is not existing yet in Qlik Sense, you would need to try to connect to the Hub/QMC with this new account first, in order to be able to see it in QMC>Users.

7. Execute the License Monitor reload task
8. Inspect the configured User Directory Connectors and change the User ID and password combination if previously configured.

[Boris_I · Accepted solution]

Hi @J_Mulholland,

No you can use directly the new service account to install Sense Sept 2020 on the new server. You don't need to use the old one.

Take a DB backup from the old server, then restore it on the new server, make sure you do the bootstrap at the end.

Follow the step from that article - https://community.qlik.com/t5/Knowledge/How-to-backup-or-restore-the-PostgreSQL-database-in-Qlik-Sen...

Change the path of the shared folder with QlikSenseUtil.exe - https://community.qlik.com/t5/Knowledge/How-to-change-the-share-path-in-Qlik-Sense-Service-Cluster/t...

Test to make sure everything is working as it should and process with the upgrade to Feb 2022.

Regards

Boris

[J_Mulholland]

Boris, thanks for the info.  I tried both the old and new services accounts but ran into an issue.  I exported and imported the certs, backed up and restored the DB but when I ran the bootstrap i got  the below -

[ERROR] Fatal exception during bootstrap: There is no RSA private key associated with this certificate. at Qlik.Sense.Communication.Security.Certificates.DotNetCert.SetPrivateKeyAccess(IdentityReference identityReference)

I cannot reach the QMC on the new server locally or from another server.  Looking at the repository logs it looks as if there is an issue with the exported certs from the old server. 

ERROR newserver301 Security.Repository.Qlik.Sense.Communication.Security.Certificates.CertValidator 24 257a9da9-ad87-476b-b27e-e651fc5b200f US\serv-qlik-t Certificate 'CN=QlikClient' (E6EBB5347AA016049BCD3B9A704484C96F1453D1) was not signed by certificate 'CN=oldserver301.us.domain.com-CA' (4FD724C494F548C019269469CC109B72D80DB7B9) Public key presented not for certificate signature at Org.BouncyCastle.X509.X509Certificate.CheckSignature(AsymmetricKeyParameter publicKey, ISigner signature)↵↓ at Qlik.Sense.Communication.Security.Certificates.CertValidator.IsCorrectlySignedBy(DotNetCert signingCert, DotNetCert cert) 257a9da9-ad87-476b-b27e-e651fc5b200f
390 20220530T164039.159-0400 WARN newserver301 Security.Repository.Qlik.Sense.Communication.Security.Certificates.CertValidator 24 58c74a11-f5b1-4b57-b349-c3414ef18c19 US\serv-qlik-t Certificate 'CN=QlikClient' (E6EBB5347AA016049BCD3B9A704484C96F1453D1) is invalid because it was not signed correctly by 'CN=oldserver301.us.domain.com-CA' (4FD724C494F548C019269469CC109B72D80DB7B9) 58c74a11-f5b1-4b57-b349-c3414ef18c19

I'm assuming the proxy cannot communicate with the DB because of the cert issue.  Any thoughts?  

[Boris_I · Accepted solution]

Hi @J_Mulholland ,

Please remove the certificate that you have imported and try again, that should do the trick.

For reference: https://community.qlik.com/t5/Deployment-Management/Qlik-Sense-Repository-Services-incorrectly-worki...

Regards

Boris

[J_Mulholland]

thanks.  I deleted the certs from the MMC and the exported cert folder in Program Data.  then ran  -bootstrap -iscentral -restorehostname  then ran-bootstrap -standalone -restorehostname again and I am now able to reach the QMC and it seems all of my restored data is in there.  I wonder if it was even necessary to import the certs from my old server?

the link you provided was helpful but i followed the steps here as well - https://community.qlik.com/t5/Knowledge/How-to-recreate-or-just-delete-certificates-in-Qlik-Sense-No...

[Boris_I]

Hi @J_Mulholland ,

Great news, when I restore an environment I usually don't import the certificate as they are recreated by the bootstrap.

Have a nice day.

Boris