Re-installed certificates appears as invalid - No access to QMC

[Karl_Lovgren-AFRY]

After performing the following steps I'm not able to access QMC or DEV-HUB anymore, even after a total re-installation

• First I installed Qlik Sense Enterprise (Client-Managed Professional User ) with the following details
  • My own user setup as "Service Account"
• Applied the latest service patch
• Launched QMC and applied my signed license
• Launched DEV-HUB, which gave me an access error
  • Root cause is that the service should not run under the same user accessing DEV-HUB
• Stopped the services and configured them with a new "Service Account" user
  • Also added write permissions on C:\Program Files\Qlik, C:\ProgramData\Qlik and the "QlikShare" folder
• Tried to start the services which failed as my new "Service Account" user was not in the groups "Qlik Sense Service Users" and "Performance Monitor Users"
• Began to reinstall by first removing the service patch
• Before repairing the installation, found the information about the needed groups and  added the service account user to the them (services now starting not starting, but no access to QMC)
• Remove the certificates as informed in the community forum (certificates re-created, but still no access)
  • Added the service account user to "Power Users" to be able to see and remove the certificates in MMC
• Tried to repair the installation
• Performed an uninstall
• Installed again, now with the service account user configured
• Still no access and the trace log files have the following error information
  • QlikSense Certificate 'CN=QlikClient' (****) is invalid because it was not signed correctly by 'CN=COMPUTER.DOMAIN-CA' (****)

How can I get around this?

I've learned my lesson that the service account user has to be setup first, but It's frustrating that a re-installation is not working!

[rzenere_avvale]

Hey, when you did uninstall, did you also marked for deletion certs and all the other content?

Riccardo

[Karl_Lovgren-AFRY]

Thanks for answering so quickly, Riccardo!

Yes, I did. When I installed again, I had to configure everything as in the first installation.

I've tried to remove and re-create the certificates several times now and have noticed the following...

• When creating the certificates using Repository.exe -bootstrap -iscentral -restorehostname " the "Trusted Root" certificate is created for both the service account and my user under "Current User"\"Trusted Root Certification Authorities"
  • Having two MMC windows open (running as different users) and deleting the certificate in one window, it's removed on the second window also (the second account)
  • Update: The QlikClient certificate is also created under "Current User>Personal>Certificates", but only for my user (not for the service account)
• When starting the service "Qlik Sense Repository Service" the QlikClient certificate is now also created for the service account user under "Current User"\Personal
  • Having  two MMC windows open (running as different users) and deleting the certificate in one window, the one for the other account is not removed.
  • When I remove the certificate for my service account the certificate is recreated when starting the service.
  • When I remove it for my account the certificate is not recreated when starting the service.

I've tried to delete the certificate QlikClient using all combinations (service account, my account, both...), but the result is the same. Error messages in the logs and no access to QMC / DEV-HUB.

[Karl_Lovgren-AFRY · Accepted solution]

I solved it by reverting to run the services under my account. Now I have access do DEV-HUB. Previously I missed to assign professional access in QMC to my user (which is RootAdmin), as I thought RootAdmin already had access to everything.