Qlik NPrinting Certificate Issue

[balajibc64]

Hi, we are using Qlik Sense with Qlik NPrinting. When we try to access the Qlik Nprinting URL  its showing warning like "your connection is not private". Then I opened the developer tool and checked under security tab, then its shows 

"The page is not secure (broken HTTPS)" Below 

Certificate - Subject Alternative name missing 

Certificate - missing (here its showing like "err_cert_comm_name_invalid") . 

any one suggest pls?

Note: Because of this first time URL is not working,  then from advance If I clicked the URL then it is working. 

Both certificate installed at same day in the Qlik Sense and Qlik NPrinting. 

[balajibc64]

Hi @Lech_Miszkiewicz Is this below steps for NRPINTING CRT and KEY File ?

1. In Qlik NPrinting Server, via SSL, I ran the below command to create the certificate. 

openssl req -new -newkey rsa:2048 -nodes -out swdohd2tqls0005_qr_qrgrp_local.csr -keyout servernameonly.key -subj "/C=QA/ST=QA/L=Doha/O=Qatar Airways/CN=" --> under CN (what name i need to give)

Step 2: Ran the below command, 

openssl pkcs12 -export -out nprint_p12_QLS0005.pfx -inkey NPrinting.key -in NPrinting.crt 

step 3: Copy the both cert and key file into the folder C:\ProgramData\NPrinting\webconsoleproxy and also Newsstandproxy and uncommented the confg file. 

step 4: then restart the Qlik NPrinting services. 

Please suggest. 

[Lech_Miszkiewicz · Accepted solution]

HI @balajibc64 

you would use Open SSL to convert PFX certificate file to CRT and KEY file. I assume you have already PFX certificate file purchased for FQDN/or wildcard of your prod nprinting server?

If you not familiar with certificates then ask your network admin to convert those files for you it will save you a hussle understing what is what. The whole conversation could be described in following steps:

1.get a wildcard certificate for your domain with private key in pfx format (for example Cert.pfx file)

2.install OpenSSL (on NPrinting server or your machine)

3.copy Cert.pfx" to "C:\OpenSSL-Win64\bin" folder and run below commands from that location.

openssl pkcs12 -in Cert.pfx -nocerts -out NPrinting-Decrypted.key

openssl pkcs12 -in Cert.pfx -clcerts -nokeys -out NPrinting.crt

openssl rsa -in NPrinting-Decrypted.key -out NPrinting.key

as result you will get NPrinting.crt and NPrinting.key file (with decrypted key). those files need to be copied to following folders (the same files copied to both of the folders below) for admin console and news stand:

C:\ProgramData\NPrinting\newsstandproxy

C:\ProgramData\NPrinting\webconsoleproxy

In above mentioned folders there are "app.conf" files which have to be modified. Find this line and modify it to point to your certificate

http.sslcert=${ProgramData}\NPrinting\webconsoleproxy\NPrinting.crt

http.sslcert=${ProgramData}\NPrinting\newsstandproxy\NPrinting.crt

restart nprinting web server

use FQDN to access nprinting console. Connection should be secure with valid trusted 3rd party certificate

That is all what it takes

[balajibc64]

Hi @Lech_Miszkiewicz Thanks for the detailed steps. I will check 

[balajibc64]

Hi @Lech_Miszkiewicz Got it all the steps. so need to get .pfx certificate from Network team. 

Because the below step only we did in our Qlik NPrinting Server, when we upgrading . 

openssl req -new -newkey rsa:2048 -nodes -out swdohd2tqls0005_qr_qrgrp_local.csr -keyout servernameonly.key -subj "/C=QA/ST=QA/L=Doha/O=Qatar Airways/CN=servername" 

[balajibc64]

Hi @Lech_Miszkiewicz Just fyi, our network suggest, 

Add the NPrinting server to load-balancing and certificate will be added from load-balance serve side.

Will it work ?

[balajibc64]

Hi @Lech_Miszkiewicz One more thing, Will able to find the pfx file in the Qlik Sense by any chance. Or need to get from Network team only.

[Lech_Miszkiewicz · Accepted solution]

Hi @balajibc64 

It is possible if it was installed with exportable option.

You can check if wildcard cert is intalled in Qlik Sense server (MMC--> add Snap-In etc...)  and then export it from there, however you would need to make sure you also get a private key exported and it will depend on whether cert on Qlik Sense was installed with the option to allow for private key export or not.

It looks like for whatever reason you dont want to talk to your network admins otherwise you would get that cert weeks ago 😂😂😂

cheers

[balajibc64]

Hi @Lech_Miszkiewicz Ha.. not like that. Our network redirecting this issue to us saying like in our self signed certificate only issue. So that, struggling for this many days. 

[Lech_Miszkiewicz · Accepted solution]

Hi @balajibc64 - I dont know. I hav enot done it that way. In bare theory it should work, but maybe there are other things I am missing.

This is not a scenario documented so you are trying to do something different than what is documented. Do it and see. We already gave you official/documented steps, you are wanting to do different steps. It is up to you.

cheers

[balajibc64]

Hi @Lech_Miszkiewicz Sure Thanks. Also I checked Qlik Sense server (MMC--> add Snap-In etc...). you are right when i tired to export this certificate its showing only .CERT to export, other option .pfx file is disabled.