Qlik Sense Enterprise on Windows can't connect to Standalone Azure PostgresDB when TLS 1.2 is enforced as minimum version

Sebastian_Linser · Nov 15, 2022 2:58:17 AM

If Qlik Sense Enterprise on Windows is deployed using a standalone DB inside Azure you can't switch the minimum TLS version to 1.2. This will cause the repository service to fail to connect to this DB server to connect to QSR and QSMQ.

You will notice that you still can connect to the DB using the QlikSenseUtil, this is due to the fact that this one is using the Npgsql PostgreSQL library, while the Repository service is using the devart library.

Environment

Qlik Sense Enterprise on Windows all versions

Resolution

This setup can only be performed on an existing installation. Current Qlik Sense installers do not support connecting to an encrypted database. Install Qlik Sense on an unencrypted database and enable encryption after the fact. See Database security for details.

To resolve this specific defect, upgrade to August 2021 IR or newer versions. See Qlik Sense Enterprise on Windows Release notes - August 2021 IR to Patch 13 and after that, encrypt your Azure PostgresDB.

**Workaround*:**

It is possible to harden the Qlik Sense Server on OS level, to only allow TLS 1.2 communication, this would open a TLS 1.2 connection to the database. Given that a minimum TLS version in the Azure portal is either not specified or below 1.2.

To verify the configuration from the server side you can develop a test application running this query

SELECT* FROM pg_stat_ssl WHERE pid = pg_backend_pid();

a result can look like this:

*Workaround can be used in case you are using a version where the fix was still not delivered.

Cause

Product Defect ID: QB-3185

MartijnOlivier · ‎2021-11-03

i have the same issue. It seems that this bug is fixed in August 2021 Patch 3. I tried that, but after a reboot it was not working. Also tried Patch 4 .. Same result, now it's not working at all anymore.

Do i need to add something to the connection string?

Sebastian_Linser · ‎2021-11-03

What is the error you see in the repository logs? Just a timeout to the qsr database after 300 seconds?

https://help.qlik.com/en-US/sense-admin/February2021/Subsystems/DeployAdministerQSE/Content/Sense_De...

Under point 7 you see what you have to add in the repository.exe.config using qliksenseutil SSL Mode=Require

The Microservices from the service dispatcher also need to be updated, how is explained as well on the link above.

When you upgrade you have to turn of encryption and revert all changes because the installer does not support SSL yet.

It was already fixed in the August Initial Release and would not be touched in a service release. Could you open a case with Qlik Support so we could have a look together and get this fixed with you.

Best regards

Sebastian