Qlik Replicate 2025.11 - Unable to Establish SSL Trust After Replacing Self-Signed Certificate (Port 3552)
Hi,
We are requesting assistance with an SSL/TLS certificate issue on our Qlik Replicate Server.
Environment: - Qlik Replicate version: 2025.11.0.285 (X64) - OS: Windows Server 2022 - Server hostname: BMTPRMPDBQLIK01.domain - Affected port: 3552 (Replicate Server/agent communication port)
Background: Our internal security team flagged the default self-signed certificate on port 3552 as untrusted (Nessus Plugin ID 51192 - SSL Certificate Cannot Be Trusted). We obtained a proper wildcard certificate issued by Sectigo (*.domain) and attempted to replace the self-signed certificate following the official documentation: https://help.qlik.com/en-US/replicate/November2025/Content/Replicate/Main/Security/set_up_server_htt...
Steps we have completed so far:
Extracted the certificate, private key, and CA chain from the client-provided PFX file using OpenSSL: - openssl pkcs12 -in <file>.pfx -clcerts -nokeys -out agent-certificate.pem - openssl pkcs12 -in <file>.pfx -nocerts -out agent-private-key.pem -nodes
Verified agent-certificate.pem contains the correct leaf certificate (subject=CN=*.domain) and agent-private-key.pem contains a valid private key block.
Built agent-ca.pem containing the Sectigo Intermediate CA and Root CA certificates (provided by the client as ca_bundle_sectigo_new.crt).
Replaced all four files (agent-ca.pem, agent-certificate.pem, agent-private-key.pem, agent-private-key-passphrase.dat) in the ssl/data directory of the Replicate Server data folder, after stopping the service.
Verified the new certificate is being served correctly via: openssl s_client -connect <host>:3552 -showcerts
Imported the Sectigo Root CA and Intermediate CA into the Windows Local Computer Certificate Store (Trusted Root Certification Authorities and Intermediate Certification Authorities) via certlm.msc.
Restarted both the Qlik Replicate Server service and the Replicate UI Server/Console service.
Current issue: After completing the above steps, the Replicate web console now returns the following error: "SYS, General - The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel."
This suggests the UI Server is still unable to validate trust when communicating internally with the Replicate Server over port 3552, despite the certificate chain appearing valid via openssl verification.
Could you please advise:
Whether there are additional configuration steps required (beyond replacing the ssl/data files and importing the CA into the Windows Certificate Store) for the UI Server to trust the new certificate on port 3552.
Whether the UI Server validates trust through a different mechanism that also needs to be updated.
Any relevant log files we should review or provide to help diagnose this further.
