Going from connections to Sense with <server.internaldomain.local> to a valid <server.customer.com>

[Skage]

Hi, all.

I don't know NP well enough to solve this so I'm hoping the community can give me some hints.

I'm trying to help out in a situation where a Sense + NPrinting environment will move from self-signed-certs to valid certs. The goal is to isolate traffic more and more and the traffic will have to go through the more restrictive topology.

No changes to the domain used for the machines or accounts, only dns names used when connecting to Sense and NPrinting.

Currently all connections that point to <server.internaldomain.local> validate without issues.

They'd like to point the communication to <server.customer.com> instead.

When trying the validation fails on the "Installed certificates are valid to connect to Qlik Sense." step.

No problems accessing Sense via this address from the NP-machine.

In reality there will be two fqdns, that resolve to a reverse proxy/loadbalancer.

One fqdn is a separate test/dev-node and the other fqdn will load balance between two Sense-proxy-nodes that in turn will load balance between the the engines on these nodes.

The documentation refer to "install" in two ways: copy file to location and install into MMC so it is not easy to know what cert is rejected or how to configure a setup like this. One of the purposes with the rp/lb is to handle these certs in one place with a proper tld that should be trusted by default.

I've tried re-exporting certs from QMC with different lists of fqdns and placed in C:\Program Files\NPrintingServer\Settings\SenseCertificates. If I remove all certs from here the old functioning connections will naturally stop working and it works if I replace them with my newly exported certs.

I can't find anything in the NP-logs that might indicate what, why and by whom it is rejected.

Can anyone point me in the right direction?

Is this possible at all or do they have to make sure that NPrinting can talk directly to the Sense-nodes via the "old" url so the certs can be used when connecting to Sense as the chosen user?

TIA

/lars

ps. The installed version is February 2024 SR1 but that isn't in the required drop down.

[David_Friend · Accepted solution]

Hi Lars, I think this is unlikely to work, since NPrinting cannot go through a load balancer, it has to talk directly with QlikSense.  Lets see if any one else has input as well!

[Lech_Miszkiewicz]

Hi @Skage 

As @David_Friend mentioned NPrinting needs to talk to Qlik Sense directly.

You can configure FQDN for Qlik Sense and install Qlik Sense certificates as per documentation here: 

https://help.qlik.com/en-US/sense-admin/May2024/Subsystems/DeployAdministerQSE/Content/Sense_DeployA...

Once you do that you need to follow a process of exporting certificates for NPrinting:

https://help.qlik.com/en-US/nprinting/February2024/Content/NPrinting/DeployingQVNprinting/NPrinting-...

Indeed - it can be overwhelming if you are not familiar with it and at the same time there is a lot of documentation you need to read through to do it by yourself.

If I were you I would ask for help your local Qlik Partner (just double check they are familari with Qlik Sense and NPrinting configuration as I saw some partenrs who only specialize say in Qlik Sense but often have limited experience with NPrinting and they would be waste of time too). If you have a good and experienced  Qlik partner they would get this done for you in no time over the teams call and it would cost you just a fraction in comparison to time you would need to invest to learn all this. 

cheers

Lech

[Lech_Miszkiewicz]

I will just add that both server have to be in the same domain as that is one of the main requirements. You can have alias and 3rd party certificate but it needs to be issued to the domain both servers are in.

as usual this is documented on https://help.qlik.com

https://help.qlik.com/en-US/nprinting/February2024/Content/NPrinting/GettingStarted/HowCreateConnect...

cheers

[Skage]

Thanks @David_Friend 

I see why this will not fly.

Issuing and installing more certs is definitely not an option and using the regular client with through the load balancer works fine.

Direct connections to the Sense server/s will be the way forward for now.