TLS 1.3 Qliksense

[Senor_Dai]

Hi,

Ive seen from support articles that TLS 1.2 is not yet supported in Qliksense however this is a workaround outlined.  

We really need to implement TLS 1.3 as a requirement from our customers.  Would amending the registry like achieve this ?



In the above example Ive added registry keys for TLS 1.0 to 1.3 and 'disabled' all apart from 1.3 which I have enabled.

Will this be detrimental to how QlikSense functions ?

Many thanks,

Dai

[mpc]

Hi, 

Enabling TLS 1.3 will cause errors, as mentioned in this KB: https://community.qlik.com/t5/Official-Support-Articles/Opening-the-Qlik-Sense-hub-shows-An-error-oc...

Here some informations about differences between TLS 1.2 and 1.3. You can disable weak cipher suits through IIS Crypto recommended settings: https://www.nartac.com/Products/IISCrypto

If access by TLS 1.3 is mandatory, you should put Qlik Sense beyond a Reverse Proxy, which handle the certificate

Kind regards

[Senor_Dai]

Hi @mpc 

Thanks for the response. 

We are running QlikSense on Windows 2022 server - whereas the article you referenced mentions Windows Server 2012, 2016 and 2019 only. Would TLS 1.3 still not work?

Can you outline what's involved by putting QlikSense beyond a Reverse Proxy?

Much appreciated

Dai

[mpc]

The KB is quite confusing indeed, because it's mention Windows Server 2012 2016 2019 or Qlik Sense all versions: 

Neither the listed versions of Windows, nor Qlik Sense Enterprise on Windows support TLS 1.3. See Supported TLS and SSL Protocols and Ciphers.
In the link above: 

Qlik Sense Enterprise on Windows:

• Full Support for TLS 1.2 from version June 2017 
• TLS 1.3/2.0 are not yet fully supported [Internal Reference ID: SHEND-1269]

By putting Qlik Sense behind a Reverse Proxy, you'll be able to use for 1.2 TLS for Qlik Sense services communications, and through the Reverse Proxy, use a 1.3 TLS certificates, to communicate from user browser to Qlik Sense Proxy. 

Please find the schema bellow: 

It this more clear ? 

Kind regards