Sense unable to locate a ssl certificate

[Clever_Anjos]

i´m not beeing able to make my Sense box use a valid SSL certificate

Error message  Couldn't find a valid ssl certificate with thumbprint

Steps taken so far:

• SSL certificate imported under MMC/Certificates/Local Computer/Personal

• Proxy configured with the thumbprint
• Proxy service restarted

Trace log

Sequence#		Level	Logger	Thread	ServiceUser	Message
1		INFO	Security.Proxy.Qlik.Sense.Common.Security.Cryptography.LoggingDigester	1	WIN-8JETLOID025\qsapp	Setting crypto key for log file secure signing: success
2		INFO	Security.Proxy.Qlik.Sense.Common.Security.Cryptography.SecretsKey	9	WIN-8JETLOID025\qsapp	retrieving symmetric key from cert: success
3		INFO	Security.Proxy.Qlik.Sense.Common.Security.Cryptography.CryptoKey	9	WIN-8JETLOID025\qsapp	setting crypto key: success
4		WARN	Security.Proxy.Qlik.Sense.Communication.Security.CertSetup	9	WIN-8JETLOID025\qsapp	No private key found for certificate 'CN=sense.meubi.com.br, OU=PositiveSSL, OU=Domain Control Validated' (1F284854608E80E245D7B640849BB03FE819048F)
5		WARN	Security.Proxy.Qlik.Sense.Communication.Security.CertSetup	9	WIN-8JETLOID025\qsapp	Couldn't find a valid ssl certificate with thumbprint 1f 28 48 54 60 8e 80 e2 45 d7 b6 40 84 9b b0 3f e8 19 04 8f
6		WARN	Security.Proxy.Qlik.Sense.Communication.Security.CertSetup	9	WIN-8JETLOID025\qsapp	Reverting to default Qlik Sense SSLCertificate
		INFO	Security.Proxy.Qlik.Sense.Communication.Security.CertSetup	9	WIN-8JETLOID025\qsapp	Set certificate 'CN=WIN-8JETLOID025' (047E90CF18BF749E1EF503E674C2B90960D04E51) as SSL certificate presented to browser

[jaisoni_trp · Accepted solution]

I would check couple of things here:

a) Does the certificate have private key i.e. do you see a key icon in certificate?

b) Double check if its stored on correct location.

[jaisoni_trp]

Per Qlik:

The definition of an invalid certificate is as follows:

• The operating system considers the certificate to be too old or the certificate chain is incorrect or incomplete.
• The Qlik Sense certificate extension (OID “1.3.6.1.5.5.7.13.3”) is missing or does not reflect the location of the certificate:
  • Current User/Personal certificate location: Client
  • Local Machine/Personal certificate location: Server
  • Local Machine/Trusted Root certificate location: Root
  • Current User/Trusted Root certificate location: Root
• The server, client, and root certificates on the central node do not have a private key that the operating system allows them to access.
• The server and client certificates are not signed by the root certificate on the machine.

[Clever_Anjos]

>>a) Does the certificate have private key i.e. do you see a key icon in certificate?

Where should I find that icon?

[jaisoni_trp]

In MMC on the certificate.

[Clever_Anjos]

Here?

I don´t have that icon.

Could you kindly guide me how to create/obtain it?

[Clever_Anjos]

Closing the topic.

The certificate was issued without the private key.

[Clever_Anjos]

a) Does the certificate have private key i.e. do you see a key icon in certificate?

[Morteza561]

I had a weird problem about this error and I've finally resovled it!

This was what I was getting in Security_Proxy Log:

Current version of .NET does not support the private key algorithm for certificate

I've got my SSL from Let's Encrypt Certbot and the problem was (according to the documentation)  key file's encryption algorythm!

https://eff-certbot.readthedocs.io/en/stable/using.html

I've came up with the idea of changing the algorithm by adding "--key-type rsa" to the end of my command and it worked like charm!

full command:

certbot certonly --manual --preferred-challenges=dns --email xxx@yyy.com --server https://acme-v02.api.letsencrypt.org/directory --agree-tos -d *.example.com --key-type rsa