Change QlikView Services communication from Windows Group Authentication to Certificate Trust

[Sebastian_Linser]

The QlikView Services communication can be changed from the traditional Windows Group Authentication to Certificate Trust. 

For basic instructions, see Configuring servers with digital certificates.

If the services need to be manually reconfigured, each service needs to have its configuration files modified.  

1. Stop all Services.
2. Change the “UseWinAuthentication” entry from “true” to “false” in the following files:
   1. C:\Program Files\QlikView\Management Service\QVManagementService.exe.config
   2. C:\Program Files\QlikView\Directory ServiceConnector\QVDirectoryServiceConnector.exe.config
   3. C:\Program Files\QlikView\Distribution Service\QVDistributionService.exe.config
   4. If using QlikView WebServer, C:\Program Files\QlikView\Server\Web Server\QVWebServer.exe.config
   5. If using IIS, the 2 following files: C:\Program Files\QlikView\Server\Web Server Settings\QVWebServerSettingsService.exe.config and C:\Program Files\QlikView\Server\QlikViewClients\QlikViewAjax\web.config
      
      
3. Open the C:\ProgramData\QlikTech\QlikViewServer\Settings.ini file in Notepad and add EnableSSL=1 or change the 0 to a 1 in the [Settings 7] section. Make sure its the first entry after  save and close the file.
   
   
4. (For 12.50 and later:) Open the C:\Program Files\QlikView\ServiceDispatcher\services.conf file.
   Change from -qv-auth-mode=ntlm to -qv-auth-mode=cert
   
   
5. Start up the services in the the following order:
   1. Qlikview Management Service, check if the certificates are getting generated under C:\ProgramData\QlikTech\LicenseService\Exported Certificates\ those are needed for the License Service
   2. Start the Qlikview Service Dispatcher Service
   3. Start all the other services any order.
      
      
6. An additional step is necessary. Services will fail to start due to undecryptable data at first. At start-up, each service validates all its encrypted data entries to ensure they are accessible. If the service encounters data that cannot be decrypted, it reports an error and stops execution.
   
   Erase corrupted data by temporarily enabling the hidden configuration EraseUndecryptableData flag.
   
   In each of the above-mentioned configuration files (except the QlikView Server settings.ini), add the EraseUndecryptableData entry and set it to true.
   
   Example: 
   

   <add key="UseWinAuthentication" value="true"></add>
   <add key="EraseUndecryptableData" value="true"></add>​

7. Start each service (QlikView Management Service, Distribution Service, Directory Service Connector, WebServer Service) once.
8. Stop the service again, open the configuration file and remove the EraseUndecryptableData entry.
9. Save the file.
10. Restart the services one by one. 

Environment: 

QlikView 

[peterwh]

Hello @Sebastian_Linser ,

I've seen the Qlik Fix Video "Qlik Fix: How to Switch to Certificate Trust". Is this still relevant if I want to switch to Certificate Trust with an existing installation or can I use only your instruction? At the moment I'm using QlikView May 2021 (An update to May 2022 or even May 2023 - when it is available - is planned for this year) and I try to figure out how much work such a switch will cause.

Kind regards

Peter

[Sonja_Bauernfeind]

Hello @peterwh 

From what I recall, the Qlik Fix video requests for you to re-install. This is not always an option for customers.

The article instructions as well as our documentation (see Configuring servers with digital certificates) provide you with detailed steps on how to carry this out without needing to uninstall and reinstall QlikView. They are accurate.

All the best,
Sonja 

[peterwh]

Hello @Sonja_Bauernfeind,

thanks for the clarification. Since we have split our large QlikView installation onto multiple servers the "re-install" would be no option for us. Now I know that there is a second way for a switch to Certificate Trust.

Kind regards

Peter