Qlik NPrinting 17 Help with SSL certificate

[lauranvh]

Hello everyone,

I'm seeking some aid for the installation of a SSL certificate in NPrinting 17 NewsStand.

I already tried the qlik help on this subject but I didn't understand completely because I don't have that much knowledge of certificates.

https://help.qlik.com/en-US/nprinting/17.2/Content/DeployingQVNprinting/Installing-ssl-certificates....

I have received a NewsStand certificate for a routed URL from the IT administrator. It contains 3 cer files that I merged into a pem file but I don't have two files that are stated in the help file. Do I need these for this to work? I don't think the 3 files i received are X509. How can I check that?

The help file also states that I have to use the Pem file as a certificate file to setup the proxy. How do I do that?

In the last part of the help file after the bold Install Certificates text. I have to put the certificates and private key (which I don't have I think) in a folder (that I found) but is that the Pem file I just made or is it something else?

You can see I'm pretty clueless about this whole thing, I hope somebody might be able to help me with this.

Kind regards,

Lauran van Hoek

[lauranvh]

This is a slight bump.

I'm still having a problem with the certificates thing.

I edited the post to make some things a little clearer.

[gustavgager]

Hi Lauren. Did you manage to solve this?

Im having similar issues. I have succsessfully got a working cert for QS using my own firewall as a CA. Im now trying to use the same cert (nprinting and sense are running on the same server).

From the CA i can get the CRT and the key files, or i can get a combined crt-file that includes the two other filer. But when i add the .key and the crt file and restart the webproxy, i get "Error Code: DLG_FLAGS_INVALID_CA". The same cert works fine with QS.

If i check the log it say:

Qlik.NPrinting.WebEngine 17.6.0.0 Qlik.NPrinting.WebEngine.Engine 20171130T111919.722+01:00 INFO NETBURST 0 0 0 0 0 0 0 0 The service is starting

Qlik.NPrinting.WebEngine 17.6.0.0 Qlik.NPrinting.WebEngine.Engine 20171130T111920.175+01:00 INFO NETBURST 0 0 0 0 0 0 0 0 Portal proxy server successfully started.

Qlik.NPrinting.WebEngine 17.6.0.0 Qlik.NPrinting.WebEngine.Engine 20171130T111920.191+01:00 INFO NETBURST 0 0 0 0 0 0 0 0 Web console proxy server successfully started.

Qlik.NPrinting.WebEngine 17.6.0.0 Qlik.NPrinting.WebEngine.Engine 20171130T111927.752+01:00 INFO NETBURST 0 0 0 0 0 0 0 0 Windows authentication server listening on http://localhost:4995/

Qlik.NPrinting.WebEngine 17.6.0.0 Qlik.NPrinting.WebEngine.Engine 20171130T111927.784+01:00 INFO NETBURST 0 0 0 0 0 0 0 0 Engine server listening on http://localhost:4996/

Qlik.NPrinting.WebEngine 17.6.0.0 Qlik.NPrinting.WebEngine.Engine 20171130T111927.784+01:00 INFO NETBURST 0 0 0 0 0 0 0 0 The service is ready at localhost:4996

Qlik.NPrinting.WebEngine 17.6.0.0 Qlik.NPrinting.WebEngine.Engine 20171130T113331.315+01:00 ERROR NETBURST 0 0 0 0 0 0 0 0 proxy: 2017/11/30 11:33:31 server.go:2848: http: TLS handshake error from 10.200.10.100:54677: EOF

[andregas]

Hi Gustav,

You need CRT and KEY file in PEM X509 format for NPrinting.

This means if you open file with text editor found following structure:

- CRT

-----BEGIN CERTIFICATE-----

...

-----END CERTIFICATE-----

- KEY

-----BEGIN PRIVATE KEY-----

...

-----END PRIVATE KEY-----

You can convert file to that format using OpenSSL tool: https://www.openssl.org/

[lauranvh]

Have you already tried doing this?

This is what I got from the Qlik Help: Installing certificates ‒ Qlik NPrinting

Certificates installation on Qlik NPrinting server June 2017 or higher

Do the following:

1. Copy the certificate NPrinting.crt and the related private key NPrinting.key into the appropriate folders:
   1. For the NewsStand: %ProgramData%\NPrinting\newsstandproxy\.Typical path is C:\ProgramData\NPrinting\newsstandproxy\.
   1. For the Qlik NPrinting web console: %ProgramData%\NPrinting\webconsoleproxy\.Typical path is C:\ProgramData\NPrinting\webconsoleproxy.
2. Change both proxy configuration files to refer to the new certificate file:
   1. Edit the NewsStand proxy configuration file: %ProgramData%\NPrinting\newsstandproxy\app.conf.Uncomment by removing the # and change or add the following lines to:http.sslcert=${ProgramData}\NPrinting\webconsoleproxy\NPrinting.crt. Change the certificate file name if necessary.http.sslkey=${ProgramData}\NPrinting\webconsoleproxy\NPrinting.key. Change the private key file name if necessary.${ProgramData} is the Windows ProgramData environment variable with the notation for the configuration file. As alternative you can insert your full path, for example C:\ProgramData\NPrinting\newsstandproxy\NPrinting.crt.
   2. Edit the Qlik NPrinting web console proxy configuration file: %ProgramData%\NPrinting\webconsoleproxy\app.conf.Uncomment by removing the # and change or add the following lines to:http.sslcert=${ProgramData}\NPrinting\webconsoleproxy\NPrinting.crt. Change the certificate file name if necessary.http.sslkey=${ProgramData}\NPrinting\webconsoleproxy\NPrinting.key. Change the private key file name if necessary.${ProgramData} is the Windows ProgramData environment variable with the notation for the configuration file. As alternative you can insert your full path, for example C:\ProgramData\NPrinting\webconsoleproxy\NPrinting.crt.
3. You must stop and restart the Qlik NPrinting web engine service because new certificates are read only during the service start-up process.

[gustavgager]

Thats what i have. I get a crt file and a key file from my CA (my pfsense firewall).

[gustavgager]

Yes. Thats the same guide that I used.

[wynandack]

Hi all, i recently resolved a similar issue we had at a client with deploying the certificates for NP17.

Few things to note:

The crt file needs to be a combination of the certs for the CA, the server and any other authorities they may use on the site or domain. ( so one file with the text of the cert files included, one after the other )

If the key file was generated with a passphrase, the passphrase needs to be stripped out/un-encrypted (we used open ssl to do this), otherwise the site will not recognize the key file.

If a .pem file is supplied (in this case a combination of the certs and key), open in notepad, cut the private key part out and copy to a new notepad, save as .key file. Then cut the certificate part out and copy to a new notepad, save as .crt file. Past the files to the respective newsstand and webconsole proxy folders, edit the .conf files to reflect the crt and key file names. Then restart the nprinting web service.

Hope this helps

[Siddhartha_Chaudhary]

Keep it very simple and follow my reply for post:

https://community.qlik.com/t5/Qlik-NPrinting-Discussions/Install-SSL-certificate-to-NPrinting/m-p/17...

Happy Sensing.

Regards

Siddartha Chaudhary