NPrinting Verification process does not capture certificate FQDN mismatch in turn resulting in GRPC errors or not able to reload metadata

[Frank_S]

Description of the issue:

• GRPC and CEF error logging issues discovered in the Task Execution and NPrinting Engine log and while attempting to preview NPrinting reports in the NPrinting Template Editor or Executing NPrinting Publish Tasks and or On Demand reports
• Result is NPrinting reports containing Qlik Sense images fail to preview normally via the NPrinting Template Editor and fail to execute normally when run as an NPrinting Publish Task or On Demand report
• The following NPrinting connection verification error may be present: "x - Sense Engine on port 4747 is reachable"
• Metadata reload may fail with "...has reached error status" registered in the logs.
• When attempting to connect to the Qlik Sense hub a 403 forbidden error generated

Environment discovered:

• April 2019 Release of NPrinting

Versions Affected:

• All versions

Resolution:

! Before proceeding check that the following has already been reviewed and addressed:

• None of the Qlik Sense charts used with NPrinting reporting use 'chart assistance'
• All charts used with NPrinting reported are supported for use with NPrinting and/or are configured as per specification See "References" below

Identify a possible FQDN certificate mismatch:

On the NPrinting server:

• Open a 'Certificates' MMC console 'local computer' (not user)
• Check the certificate store/personal and trusted root store.
• Identify the FQDN
• ie: mycertQSserver1.domain1.com

On the Qlik Sense server: 

• Export the Qlik Sense certificates via the QS QMC certificate export menu option 
• View the certificate properties checking the FQDN path
• ie: mycertQSserver1.newdomain.com

Result: If the FQDNs do not match, you have a FQDN certificate mismatch

• NP server: certificate originally imported from Qlik Sense server: mycertQSserver1.domain1.com
• Current Qlik Sense certificate exported: mycertQSserver1.newdomain.com

How to resolve the issue if a certificate mismatch can be identified

• Abort

1. ALL pending and or open Task Executions in the NP web console via the Admin>Executions page
2. ALL pending and or open On-Demand request executions in the NP web console via the Admin>On-Demand requests page

• Disable all Publish Tasks. No Task or On-Demand executions should be in the process of execution during the certificate export and import process. 

Next:

• Using the QS QMC 'Certificates' interface, re-export the Qlik Sense certificates using the following attributes
  • no password and
  • 'include secret key' check box enabled and
  • Insert FQDN (Fully Qualified Domain name path) of the NPrinting server (avoid using an IP address to ensure future DNS resolution flexibility) ie: myNPserver1.domain.com

(Reference: Connecting Qlik NPrinting with Qlik Sense )

• Export the certificates
• Copy the newly exported certificates to the NPrinting server
• Log onto the NPrinting server as the NPrinting service account
• Run the NPrinting certificate installer program which will import the certificate files to there respective certificate stores on the NPrinting server
• Click 'Yes' to remove the previously installed certificates (note if the certificate FQDN path is a mismatch with the recently exported QS certificates)
• Restart all five NPrinting services

Finally:

• Previewing your NPrinting reports should work as expected
• Enable Publish Tasks as needed. These should now execute as expected
• On Demand reporting may now proceed normally
• If issue persists, check out the suggested time out values as per the following article "Advanced troubleshooting of the GRPC and or CEF Error Issues" have been applied however the GRPC errors persist and report generation which contain Qlik Sense images fails.

Cause:

What caused this issue after running successfully for many months consecutively

• The Qlik Sense server certificates may have been recently regenerated/recreated thus requiring those newly re-generated certificates to be exported for use with NPrinting then re-imported into NPrinting as mentioned in the resolution section of this article
• The trusted root authority associated with the originally exported certificates has recently been changed and the NPrinting certificates have not been updated accordingly
• The mismatch is not currently identified by the NPrinting connection verification process. NOTE: An improvement request has been made with R&D to provide a clearer 'verification' check in future versions of NPrinting

Internal Investigation IDs:

• OP-9457

Reference: 

Creating visualizations using Insight Advisor chart suggestions
Enabling export of your visualization extension
Using Qlik Sense third-party extensions