NPrint connection to Qlik Sense failing on certificate validation (AWS)

[cjcunningham]

I'm running a single node qlik sense and single node NPrint on separate ec2s in AWS. The NPrint server and single engine are running on the same machine as well. I've had issues for a while now getting the two machines to connect via the qlik sense box's proxy address.

I recently had the two machines joined to the same domain and switched the qlik services to utilize the same windows service domain user account. But that hasn't fixed the issue either so far. I've tried to have all of the ports open that the documentation mention but that's yielded no luck either.

Any advice on this issue would be greatly appreciated. Whenever I run the 'run verification' test via the NPrint console, I don't see any logs on my NPrint server get updated either. 

Here's some specific questions I have.

• Is there an increased logging I could enable that would give me more details as to why this test is failing?
• Also if anyone knows the specific ports involved with this connection process that could be helpful too.
• I've included where I put the certificates on the NPrint machine that I exported from qlik sense.
  • Is it right that all 3 files should be there?
  • I tried exporting them with the secret key and without.
  • I've also tried setting the machine name of the certificates to the NPrint machine's name listed in Window's 'about' page, as well as using its private IP address. I'm uncertain if the machine name provided on the certificate page actually affects anything when the NPrint machine runs with a single NPrint engine.

[Lech_Miszkiewicz]

Hi. 

Few remarks:

• when both servers got joined into the same doamin did you re-install NPrinting?
  • did you keep the same host name for it?
• I always use separate service account (separate domain account) to run NPrinting and Qlik Sense services - that prooved to me to be golden ticket solving many issues in the past. I am not sure about current requirements but you can read it here): https://help.qlik.com/en-US/nprinting/February2024/Content/NPrinting/DeployingQVNprinting/User-accou...
• When exporting services make sure you follow steps as documented, pay atention to host name when putting it when exporting certificates (NPrinting host name and not Qlik Sense host name!!!!) : https://help.qlik.com/en-US/nprinting/February2024/Content/NPrinting/DeployingQVNprinting/NPrinting-... 
  • always follow documentation in that regard!
• I dont know how you have configured ADMIN-->Settings-->Task section where you have "Apply Qlik Sense server certificate validation checkbox" - that setting requires you to use FQDN - all details as always in documentation: https://help.qlik.com/en-US/nprinting/February2024/Content/NPrinting/AdministeringQVNprinting/Admin-...
  • https://help.qlik.com/en-US/nprinting/February2024/Content/NPrinting/DeployingQVNprinting/NPrinting-...

That should do for now.

cheers

[cjcunningham]

Hello, 

Thanks for the info.

1. I did reinstall nprint on the server after the domain join was complete
   1. The host name did change. As far as I know I'm using the new host name when generating the certificates. 
2. In our previous qlik environment, running on june 2020 versions, we used the same domain user for qlik sense and qlik nprint. I was under the impression that that was ideal when doing single node environments. 
3. I've tried using the listed hostname as well as the fqdn and the private ip. Should the secret key be checked? I think I've tried with and without.
4. I've tried disabling the "Qlik Sense server certificate validation checkbox" and that doesn't seem to have made a difference either.

Is there a log/log level I could utilize to see more specifically what is failing in my testing?

[Lech_Miszkiewicz]

Hi @cjcunningham 

hmm I dont know what to say. If you follow istructions and meet all requirements as per documentation you should be ok. You are asking "Should the secret key be checked?" - I say - it was in documentation right there in the step by step video:

hence I question if you actually thoroughly studied it and followed it as it is critical to meet all requirements listed there? If you did and you simply missed it - maybe go through it again and pay attention to every detail. All requirements MUST be mets!

Once again regarding the actual error:

https://help.qlik.com/en-US/nprinting/May2023/Content/NPrinting/Troubleshooting/Verify-connection-to...

So my usual steps to troubleshoot something like this are:

• check if both servers are in the same domain - Qlik Sense also must be installed in domain!
• check if user accounts belong to the same domain
• check if domain meets all criteria - making sure you did not install NPrinting nor Qlik Sense on domain controller machines: https://support.qlik.com/articles/000064443
• once thats done I check if all required ports are open: https://help.qlik.com/en-US/nprinting/May2023/Content/NPrinting/DeployingQVNprinting/Ports.htm
• I also check if windows authentication works when trying to open Qlik Sense app from NPrinting machine
  • do I get windows login popup - If I do is it due to group policies or something else?
  • If group policies - then I check to allow SSO to log me in and test again
• I export certificates using steps from the video and link from help site and I make sure to pay attention to which user I use when installing certificates (refer to help site instructions!)
• i check engine requirements (note details about ports and supported Qlik Sense versions!!): https://help.qlik.com/en-US/nprinting/May2023/Content/NPrinting/DeployingQVNprinting/Installing-qlik...
• I check server requirements: https://help.qlik.com/en-US/nprinting/May2023/Content/NPrinting/DeployingQVNprinting/System-requirem...
• I check if all services are running
• I check if engine is Online (in Admin --> Engine section)
• Check logs: https://help.qlik.com/en-US/nprinting/May2023/Content/NPrinting/Troubleshooting/Troubleshooting-logs...
• Check Windows Events logs - sometimes 3rd party antivirus (AV) can prevent connection and needs to be whitelisted
• I reboot both machines

Lastly - it is never ideal to use the same service account for both services as it is hard to troubleshoot. Also there is no line in documentation saying that such setup would be ideal so I am wondering where did you take that assumption from. I have had very heated conversation few years ago with qlik employee on that very subject and it turned out that having dedicated accounts solved the problem for me then, so I will always stay by what i said earlier - have dedicated account for NPrinting services (it can be 1 account for all 3 NPrinting services, but different than Qlik Sense service account). I mean-again if you read documentation i provided links to you would see this:

Lastly - If you are 100% sure that you met all requiresemtns and you are doing everything by the book / help site and it still does not work then open support ticket with Qlik as in such situation you need someone hands on looking at your environment and you dont want to share details here on community.

additional targeted help site links:

• https://help.qlik.com/en-US/nprinting/May2023/Content/NPrinting/DeployingQVNprinting/NPrinting-with-...
• https://help.qlik.com/en-US/nprinting/May2023/Content/NPrinting/DeployingQVNprinting/Supported-unsup...

good luck!

cheers

Lech