What is Qlik's self-signed certificate used for in an on-prem Qlik Sense server environment?

[mbespartochnyy]

I'm having trouble understanding what the self-signed certificate is used for in an on-prem Qlik Sense server environment. More precisely, I'm referring to the self-signed certificate which is stored in Certificates (Local Computer) > Personal > Certificates location in Microsoft Management Console (MMC).

Service certificates documentation has this sentence about the self-signed certificate:

The service certificate and service private key are used for server authentication when your service acts as a server, that is, when another service calls an API in your service.

I find that sentence a bit too confusing.

Does anyone know, in layman's terms, what exactly a self-signed certificate used for in an on-prem Qlik Sense server environment?

[mpc]

Hi, 

When you connect to Qlik Sense, it's establish a secure connection between your computer and Qlik Sense. To do that, it's need a certificate, a file which says "Yes, I'm Qlik Sense". 

But as you can see when connecting, your browser display an error. It's because it's Qlik Sense who says "Yes I'm Qlik Sense". That called a self-signed certificate. 

To truly secure the connection, you need to install a certificate signed by a external provider. Like an ID Card signed by your Government. It will say "Me, the third party, garantuee that this server is Qlik Sense"

I hope I'm more clear than the doc. 

Kind regards

[mbespartochnyy]

Thanks for the reply @mpc!

I did a bit of experimenting today and the results I got suggest that the self-signed certificate is doing more than securing communications between Qlik Sense server and client PCs.

I have an internal Certification Authority (CA) at my company and I went through the process of creating Certificate Signing Request, installing the certificate I received from internal CA, and configured Qlik Sense proxy settings to use the certificate generated by the internal CA. Doing so resolves the whole "connection is not secure" message, but what I did next broke my Qlik Sense server.

After installing the certificate from internal CA, I went ahead and deleted the original self-signed certificate and restarted my Qlik Sense server. The thought was "since Qlik Sense is now using the new cert, I no longer need the original one."

However, when I deleted the original self-signed certificate, both Hub and QMC broke:

They broke even though all of Qlik Sense services are running fine:

This suggests that the self-signed certificate is doing more than securing communications between a Qlik Sense server and client PCs.

Do you know what else the self-signed certificate is used for?

[mpc]

Indeed the self-signed certificate is used by the authentication mechanism between Qlik Sense services. 
Remove it then will broke Qlik Sense. 

Complete process is available here: How to change the certificate used by the Qlik Sen... - Qlik Community - 1712773

To recreate the certificate: How to recreate or just delete certificates in Qli... - Qlik Community - 1712692

Good luck !

[rwunderlich · Accepted solution]

The certificate is used as an authentication mechanism between services -- eg between the Proxy Service and the Repository Servive to generate a list of Apps for the Hub. The certificate is used like a key card and sent with the API call. If the call presents the certificate, then it's trusted.

-Rob

[mbespartochnyy]

Thank you both! It's starting to become clearer. It sounds like the self-signed certificate is used to authenticate the identity of server on which Qlik Sense is installed and to encrypt communications between Qlik Sense services.

What about encryption of data connection strings and credentials?

I read through the How to recreate or just delete certificates in Qlik Sense - No access to QMC or Hub document which, at the very beginning, mentions this:

It sounds like the self-signed certificate might also play a role in encrypting data within QSR database. The rest of the document seems to suggest that credentials used when creating data connections are also encrypted using (I assume the self-signed) certificate.

Is the self-signed certificate also used to encrypt credentials for data connections or is the self-signed certificate only used for server authentication and to secure communications between Qlik Sense services?

[mpc · Accepted solution]

You're right, it's also encrypt credentials for data connection. Then, deleting and recerating it force you to retype credentials 

[mbespartochnyy · Accepted solution]

It sounds like in an on-prem Qlik Sense server environment, there are three roles that the self-signed certificate serves. They are:

• Secure communications between the Qlik Sense server and client PCs.
  • That is unless the self-signed certificate is replaced by a certificate generated by a trusted third-party or by an internal Certification Authority.
  • Side Note: Recreating the self-signed certificate won't cause any issues here.
  • Another Side Note: Changing the third party certificate, if one is used, will require changes to proxy settings in QMC in order for Qlik Sense to use the new certificate.
• Secure communications between Qlik Sense services.
  • Applies to both a single node site and to a multi-node site.
  • Side Note: Recreating the self-signed certificate won't cause any issues here.
• Secure credentials of data connections
  • Side Note: Recreating the self-signed certificate will result in a need to re-enter password for every password-protected data connection.

There are no other known roles that self-signed certificate plays in an on-prem Qlik Sense server environment. Is that accurate?

[Senor_Dai]

Hi,

We've been picked up by an external PenTest for using self signed certificates.  We have a third part SSL installed for the Hub/QMC - can this be used to replace the self signed cert?

Many thanks

[mpc]

Hi, 

You can to it by register the cert in the QMC > Proxy > Security section. You must not uninstall the Qlik self-signed one

Best