ERR_SSL_KEY_USAGE_INCOMPATIBLE Error After Qlik Replicate Windows Patch/Upgrade

[Dana_Baldwin]

After upgrading from Windows 10 to Windows 11, or applying certain patches to Windows Server 2016, Qlik Replicate may not load in the browser.

The following error is displayed:

ERR_SSL_KEY_USAGE_INCOMPATIBLE

Data Integration Products November 2021.11 or lower require a manual generation of SSL certificates for use. See Step 5 (options one and two) in the solution provided below.

Environment

Qlik Replicate 2022.11 (may happen with other versions)
Qlik Compose 2022.5 (may happen with other versions)
Qlik Enterprise Manager 2022.11 (may happen with other versions)
Use of the self-signed SSL certificate
Windows 11
Windows server 2016

Resolution

This issue has to do with the self-signed SSL certificate. Deleting the existing one and allowing Qlik Replicate/Compose/Enterprise Manager to regenerate them resolves the issue.

1. Stop the services for all affected software. Example: AttunityReplicateUIConsole, Qlik Compose or Qlik Enterprise Manager.
2. (This step only applies to Qlik Replicate) Rename the data folder under the SSL folder (\Program Files\Attunity\Replicate\data\ssl\data)
3. Delete self-signed certificates in the management console
   1. Open a command prompt and enter MMC to open the console (on Windows Server, open "Manage computer certificates")
   2. Click the File drop-down menu and select Add/Remove snap-in
      

      
      

   3. Select Certificates and click Add
      

      
      

   4. Select Computer account. Click Next, then click Finish.
      
      

      

   5. Click OK to close the Add or Remove Snap-ins window
   6. Open Certificates and navigate to Local Computer, then Personal, then Certificates
      
      

      

   7. In the list of certificates shown, select the certificates where the "Issued To" value and the "Issued By" value equal your computer name and delete them.
   8. Close the Management Console.
      
      
4. Next we will remove the reference to the self-signed certificate in Qlik Replicate:
   
   
   1. Open a command prompt As Administrator
      
      For Qlik Replicate:
      
      Navigate to the ..\Attunity\Replicate\bin directory and then run the following command:
      
      RepUiCtl.exe certificate clean
      

      
      
      
      For Qlik Compose:

      Navigate to the ..\Qlik\Compose\bin directory and then run the following command:
      
      ComposeCtl.exe certificate clean
      
      

      For Qlik Enterprise Manager:

      Navigate to the ..\Attunity\Enterprise Manager\bin directory and then run the following command:
      
      aemctl.exe certificate clean
      
      
   2. Run the command: netsh http delete sslcert ipport=0.0.0.0:443
      
      Note, that you may get a message that the command failed in the event there are no certificates bound to the port. This message can be ignored.
      
      
5. Add either a self-signed Certificate or a trusted and signed Organization Certificate.
   
   Option One: Trusted and Signed Certificate. Generate an organization certificate that must be a correctly configured SSL PFX file containing both the private key and the certificate.
   
   Option Two: Self-Signed Certificate. Generate a self-signed certificate on the server to replace the existing self-signed certificate. The provided PowerShell examples generate an SSL certificate for 10 years.
   
   Run the following in PowerShell:
   
   $cert = New-SelfSignedCertificate -certstorelocation cert:\localmachine\my -dnsname <FQDN> -NotAfter (Get-Date).AddYears(10)
   
   
6. Once the certificates have been obtained or generated, follow the instructions for the individual product section on how to import a certificate:
   
   
   • Qlik Enterprise Manager: Replacing the self-signed certificate on Windows 
   • Qlik Replicate: Setting Up Qlik Replicate Server HTTPS support 
   • Qlik Compose: Replacing the self-signed certificate on Windows 
     
     
7. Start the services.
8. You may need to clear browser cache/cookies & etc. before you can access the web page outside of incognito mode.

Qlik Replicate will now allow you to open the user interface once again.

If users still cannot log in and are returned to the log in prompt at each attempt, see How to change the Qlik Replicate URL on a Windows host.

It is recommended to use your organization certificates  

Related Content:

How to change the Qlik Replicate URL on a Windows host 

Google Chrome Community

Microsoft Answers

[tiewoods]

Today, I had the same error appear for me.  After working with my IT group and testing a few other things we have narrowed this down to my profile on the server and the Chrome browser.  When I remoted into the server and tried the URL in Chrome just like I have in the past, it failed with the error in this article.  I gave my IT domain admins permission to Qlik Replicate, they logged into the server used Chrome and logged into the Qlik Replicate.  I tried IE (Yes it is old) but Edge is not on the server, and I was able to log into Qlik Replicate.  I used Edge from my laptop over the VPN and it logged in without any error.  Chrome fails on laptop.  So our conclusion is, something to do with my profile on the server and the Chrome browser.  I tried all the steps above and it still did not solve the problem.  We are running Server 2019 and 2012.11.0.469 version of Qlik Replicate.  I will be upgrading soon and IT may rebuild my profile on that server.  Just wanted to share this with anyone else who may have the same error.

[Dana_Baldwin]

Hi @Manjunathps 

Please open a support case for assistance.

[beebs23]

Solution does not work for Microsoft Edge. My organization requires this browser. I'm using Qlik Replicate (2021.11.0.349). I've run through these steps several times, I've cleared all browser data, but I'm still getting the same error.

[tiewoods]

Yesterday, I had a problem with Qlik Replicate where the web interface would not load in Chrome/Edge from local server and my laptop.  I could only resort to using IE as a last-ditch effort and it loaded the web interface so I could see the Qlik Replicate issue and fix it.  I have opened a ticket with my IT Web team for further assistance with certificates.  I will add that the security in my company has the windows updates applied every month.  I can share a screenshot of the OS the server has along with a Windows Patch history if this is helpful.  I do not think this is a profile issue as my IT team suggested earlier in my previous posting.  Once I find more, I will update this article.

[Dana_Baldwin]

Hi @beebs23 

Has your environment recently disabled NTLM authentication? If so, users will need to log in with username@domain.com rather than domain/username as the format is not supported by Kerberos.

If this is not the situation, please open a support case.

Please note, we expect that use of a signed certificate would also resolve this issue if that is an option for you.

Thanks,

Dana

[Dana_Baldwin]

Hi @tiewoods 

I am assuming you already tried the steps above and it did not help. 

Has your environment recently disabled NTLM authentication? If so, users will need to log in with username@domain.com rather than domain/username as the format is not supported by Kerberos.

If this is not the situation, please open a support case.

Please note, we expect that use of a signed certificate would also resolve this issue if that is an option for you.

Thanks,

Dana

[tiewoods]

@ Dana_Baldwin - Thank you for your information.  I have sent this over to our IT team to have them check.  I want to be clear that the log in screen does not appear and when I used IE I never even got prompted to login, it brought me right into Qlik Replicate. Thank you again.  I will update this when I hear back from my IT team.

[beebs23]

I imported a signed certificate and that resolved the issue.

[tiewoods]

We imported a new signed certificate, and the error no longer happens.  Thanks to everyone for their help.