Qlik Sense Mobile: Invalid Certificate error after SSL certificate replacement (Incomplete Chain)

[ArpadWeitz]

After replacing an expired SSL certificate on a Qlik Sense Client-Managed environment, on-premises / desktop browser access works correctly. However, the Qlik Sense Mobile app (both iOS and Android) displays an “invalid certificate” or “not secure” error and does not show the login screen.

Invalid certificate / This certificate is not secure

Mobile browsers on the same devices can reach the hub and display the login page without issues.

Environment:

• Qlik Sense Enterprise on Windows (Client Managed)
• Qlik Sense Mobile app (iOS and Android)
• SSL certificate issued by GoDaddy (especially newer R1 intermediate certificates)

Resolution

The Qlik Sense Mobile app is stricter about certificate chain validation than most mobile browsers. An incomplete chain causes the app to reject the connection even when browsers accept it.

1. From a machine that can reach the Qlik Sense server, run the following command and review the output: openssl s_client -connect yourserver.domain.com:443 -showcerts
2. Look for Verify return code: 20 (unable to get local issuer certificate). This indicates the server is not sending the complete chain.
3. Re-download the certificate bundle from GoDaddy, selecting the full chain/bundle option.
4. Confirm the downloaded bundle contains three certificates:
   1. Server (leaf) certificate
   2. GoDaddy TLS Intermediate CA DV – R1v1
   3. GoDaddy R1-to-G2 cross-signed certificate
5. Install the complete bundle on the reverse proxy / IIS / load balancer that terminates SSL for Qlik Sense and re-bind the certificate.
6. Restart the relevant service(s) after binding the new certificate.
7. On the affected mobile devices:
   1. Fully close the Qlik Sense Mobile app (remove it from recent apps/app switcher).
   2. Restart the mobile device.
   3. Reopen the app and try logging in again.

Important: Always verify the full chain with openssl s_client -connect ... -showcerts after making changes. The presence of only two certificates in the chain is a common cause of this issue with newer GoDaddy certificates.

Cause

GoDaddy’s newer certificate hierarchy uses an intermediate certificate named “GoDaddy TLS Intermediate CA DV – R1v1”. This intermediate is not yet trusted by all clients. To maintain compatibility, GoDaddy provides an additional R1-to-G2 cross-signed certificate that links the new intermediate back to a widely trusted root.

When only the leaf certificate and the R1 intermediate are installed (a common default when downloading a basic chain), the server does not present the cross-signed certificate during the TLS handshake.

The result is: Verify return code: 20 (unable to get local issuer certificate)

Most modern mobile browsers already trust the new GoDaddy root and can complete the connection. The Qlik Sense Mobile app, however, performs stricter certificate path validation and requires the complete chain, including the cross-signed certificate. This difference causes the “invalid certificate” / “not secure” error exclusively in the mobile app while desktop and mobile browsers continue to work.

[agigliotti]

The same is happening via browser with Chrome.

[Sonja_Bauernfeind]

Hello @agigliotti 

Thank you for your comment! Just to verify, so I understand your note correctly: Could you confirm that you are seeing (or have seen) the same issue with Chrome on a mobile device (used instead of the Qlik Sense Mobile app) and resolved it with the same steps?

All the best,
Sonja 

[agigliotti]

Hello @Sonja_Bauernfeind ,

I have seen the same issue with Chrome browser on desktop client.
I have fixed it using the CA-intermediate certificate.

[Sonja_Bauernfeind]

Thank you for clarifying, @agigliotti 

All the best,
Sonja