NPrinting Feb 2024 SR2 "Installed certificates are valid to connect to Qlik Sense" validation error

[Lech_Miszkiewicz]

Hi @Frank_S @Ruggero_Piccoli @Gianluca_Perin 

This time I am facing error which I am unable to resolve. I am helping my friends to setup and configure their NPrinting environment. Environment description:

• Single Domain
  • Qlik Sense server (Qlik Sense November 2023) running on Windows 2022 Server Datacentre
  • NPrinting server (NPrinting Feb 2024 SR2 - there was no lable for that version)
    • NPrinting Server and Engine is installed on single machine

I guided them step by step with everything while watching and instructing them via teams regarding all steps and configuration. Now we have issue when trying to create connection to Qlik Sense app. When running validation we get error (red cross) on "Installed Nprinting certificates are not valid to connect to Qlik Sense" check. 

The app we are trying to connect to is a simple app with Ctrl+0+0 script and single straight table chart - created only for testing, but in fact NPrinting is not even able to read the app since it has connectivity issue due to this certificate problem.

As far as I can tell we have everything done by the book and all other environments I have setup worked without issues in the past.

We have added NPrinting engine service account to root admins in Qlik Sense. That service account is a domain account belonging to the same domain as Qlik Sense and NPrinting.

NPrinting February 2024 SR2 is installed and activated on dedicated server running on:

• Edition              Windows Server 2022 Datacenter
• Version             21H2
• Installed on    ‎05.‎07.‎2024
• OS build           20348.2582

NPrinting Engine is active and Online.

NPrinitng is installed on server in domain "xxx.local". That is the same domain which Qlik Sense runs in. It runs on domain account which meets all requirements from: 

• https://help.qlik.com/en-US/nprinting/February2024/Content/NPrinting/DeployingQVNprinting/User-accou...

We have verified all requirements for server and engine: 

• https://help.qlik.com/en-US/nprinting/February2024/Content/NPrinting/DeployingQVNprinting/System-req...
• https://help.qlik.com/en-US/nprinting/February2024/Content/NPrinting/DeployingQVNprinting/System-req...

We have enabled TLS 1.2 on Qlik Sense and NPrinting servers. We have checked and verified with "telnet" that port communication is opened on 443,4242,4243 and 4747 to Qlik Sense. We also checked required cipher suits as per https://help.qlik.com/en-US/nprinting/February2024/Content/NPrinting/DeployingQVNprinting/TLS-cipher.... 

We have followed all steps required to export Qlik Sense certificates and installed them on NPritning machine. We paid close attention to the hostname required when exporting certificates. We have tried doing this multiple times. Also we checked that the certificate file was "Unlocked" on the NPrintign server

We have disabled "Apply Qlik Sense server certificate validation" in ADMIN-->SETTINGS-->TASK--> checkbox  "Apply Qlik Sense server certificate validation". We did that few times (enabled/disabled) to make sure it didnt stall.

We also tried following below steps: https://help.qlik.com/en-US/nprinting/February2024/Content/NPrinting/Troubleshooting/NP-wont-read-QS... 

We have reviewed also this post: https://community.qlik.com/t5/Qlik-NPrinting/Installed-Nprinting-certificates-are-not-valid-to-conne... and follow all steps from there with no success. 

It is first time ever I am facing this issue when installing and configuring NPrinting and I cannot see anything else to check with support articles,help site or community regarding this problem. 

My collegues opened support case regarding this (Qlik Support Team Your case number is : 00294396) so if there is any confidential information required I will be happy to provide it there. That case includes also logs.

I wonder what I missed - hope you guys can help.

cheers

[Ruggero_Piccoli]

Hi @Lech_Miszkiewicz ,

It could be a Messaging service issue. Check https://help.qlik.com/en-US/nprinting/February2024/Content/NPrinting/Troubleshooting/Qlik-NPrinting-....

Best Regards,

Ruggero

[Lech_Miszkiewicz]

Hi @Ruggero_Piccoli - ok - I am on it - will get back to you once I test your suggestions.

thanks

[Lech_Miszkiewicz]

Hi @Ruggero_Piccoli,

Messaging service seemed to be working fine. Regardless we stiI went through all the steps from the article but that did not help.

thanks

Lech

[Frank_S]

@Lech_Miszkiewicz I will also have a look at the case directly and support from there. Cheers!

In the meantime, I helped another customer virtually identical issue recently with the following:

• ensuring that you connect directly from the NPrinting connection to the Qlik Sense 'Virtual Proxy' associated 'proxy' node via the computer name (FQDN) of this node
• do not connect from the NP connection to any alias or Network Load balanced address associated with/redirected to the QS virtual proxy.
• Ensure that virtual proxy node uses window 'ticket' (not saml nor any other auth method)

Kind regards....

[Frank_S]

Also this as this is commonly - and admittedly - easily missed (must be done with the right user account or it will not help).

https://help.qlik.com/en-US/nprinting/February2024/Content/NPrinting/Troubleshooting/NP-wont-read-QS...

Updating your intranet security settings

Certain intranet settings may block connections to Qlik Sense servers. If a server is not responding, you should change the intranet settings.

Do the following:

1. Log into the Qlik NPrinting Server using the Qlik NPrinting Domain User Service Account credentials that run the Qlik NPrinting scheduler service.
2. Open the Windows Control Panel.
3. Go to Internet Options.
4. Click Change security settings.
5. Click the Security tab.
6. Select Local Intranet.
7. Click the Sites button, click the Advanced button.
8. Add all of the Qlik Sense Proxy Server computer names to the list, including the domain name: https://sense_proxy_computer_name.domain_name.
9. Click Close.
10. Click Ok twice to close the Internet Properties window.
11. Repeat this process on each Qlik NPrinting Engine running the Qlik NPrinting Engine service, using the Windows Qlik NPrinting Engine services administrator.

[Lech_Miszkiewicz]

Thanks Frank - I will get back to you once we test it (We will consider both your comments). I really hope this works this time.

thanks

Lech

[Lech_Miszkiewicz]

Hi @Frank_S 

Those settings were managed by GPO. For testing we excluded it from GPO and did the changes as per your instructions but still it did not help. I guess our best bet at the moment is to get someone from Qlik to have a session with client so they could check everything again, collect whatever information they need and take it from there.

cheers

Lech

[Frank_S]

@Lech_Miszkiewicz 

I'm sure you already did this but just to be doubly sure, please do ensure that when you log onto the NP server as the NP scheduler service account, it should appear as similar to the image below.

If the local intranet websites are blank again, then you need to go back in, re-enter the QS Virtual actual computer name (add this too) and FQDN server address(s).

Group Policy needs to be blocked from overwriting these fields for the NP scheduler service user account on the NP server.

Also I agree, yes please to continue via the case and I will monitor the progress from there. We discussed this case in our call yesterday and (in addition to myself) one of our Seniors in your time zone is also now monitoring and supporting your support engineer.

Cheers...fs

[Lech_Miszkiewicz · Accepted solution]

Hi @Frank_S @Ruggero_Piccoli 

Ridiculous scenario:

• Qlik NPrinting service account
  • during installation was added as root admin to Qlik Sense
  • was active in AD and working
  • when creating Qlik Sense app was working
  • but with time (when UDC synced it with AD) it got status "Inactive" due to AD filter on UDC connector

Because the NPrinting connection validation error was constantly stopping at proxy certificates we were mislead by this process and focuesed on wrong things.

The only reason we found out about the issue was when I suggested using NPrinting service account to login to QMC and then it turned out it was Inactive:

Conclusion:

• yes - it is one of the main requirements to have NPrinting service account to be root admin 
• yes - we checked above at the time when we added that account manually:
  • open Qlik Sense Hub --> User appeared in user list in QMC --> we set its role to Root Admin and it was active at the time
• the misleading error caused us to look in wrong direction and focused on wrong things
• there was no log indicating the root issue
• having a log stating exactly what it said in web browser when trying to access QMC ("Your account is inactive.....") would be a 1 minute troubleshooting job.

I have seen a lot of different scenarios and normally I would be able to identify issue quickly, however in this case given clients very secure environmnet and lack of ability to "play" alone with it, it was hard to spot the obvious.

Anyway - lesson learned - the validate connection process not necessarily produces comprehensive guidence to how to resolve the issue. 

cheers