Skip to main content Skip to complementary content
Qlik Resources

Qlik NPrinting will not read Qlik Sense certificates

You have added your Qlik Sense certificates to the correct folder on your Qlik NPrinting Server and Qlik NPrinting Engine machines. However, Qlik NPrinting services will not read them.

Possible cause  

  • The Qlik Sense certificates did not export properly.
  • Your security settings require certificates to be stored in the user certificates store.
  • Your intranet security settings may need to be changed.

Proposed action  

Make sure that you have followed the requirements on Connecting Qlik NPrinting with Qlik Sense. If that does not solve the issue, re-export your certificates and update your intranet security settings.

Re-exporting the certificates

A Qlik Sense administrator or a user with a RootAdmin account should follow these export instructions: Exporting the certificates from the QMC.

Installing the certificates in the user certificates store

Qlik Sense only needs the client.pfx certificate file to accept connections. If this certificate is copied to the Qlik NPrinting installation folder (C:\Program Files\NPrintingServer\Settings\SenseCertificates), it will be read and used to sign requests to the Qlik Sense server. There is no need for the server.pfx and root.cercertificates.

If your security policies require that certificates not be stored in a file system, Qlik NPrinting can read certificates from the user certificates store. You need all three certificates: client.pfx, server.pfx, and root.cer. You must use the QmcCertificatesInstaller.exe tool to install certificates in the store. It combines all three into a trust chain, and stores them in the certificate store.

Warning noteYou can only connect to one Qlik Sense server if you use the certificates store. You need to install certificates to the file system if you want to connect to multiple servers.

Do the following:

  1. Receive the exported and renamed Qlik Sense certificates from your Qlik Sense system administrator.

  2. Log into the Qlik NPrinting Server running the Qlik NPrinting scheduler service, as the Windows Qlik NPrinting Server services administrator.

  3. Add the certificates to C:\Program Files\NPrintingServer\Settings\SenseCertificates. Qlik NPrinting will automatically identify the correct one to be used for each connection.

    Information note

    You should only keep active Qlik Sense certificates used by Qlik NPrinting connections in the C:\Program Files\NPrintingServer\Settings\SenseCertificates folder.

    We recommend you remove any certificates that are not in use.

  4. Repeat this process on each Qlik NPrinting Engine running the Qlik NPrinting Engine service, using the Windows Qlik NPrinting Engine services administrator.

Additional user access allocation in Qlik Sense is not required for a user to view reports in the Qlik Sense hub.

Understanding error logs for server certificate validation

If you use server certificate validation, the error logs include troubleshooting instructions for the most common configuration errors. Logs are stored in the %ProgramData%\Nprinting\Logs folder. The default location is C:\ProgramData\NPrinting\Logs.

Here are some examples:

Qlik Sense remote server certificate validation failed with SslPolicyErrors RemoteCertificateChainErrors and ChainStatus with 1 element(s): [Status=UntrustedRoot, Info=A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.]

Please be sure to have exported Sense 'root.cer' certificate from Sense server QMC (this must be repeated for each Sense server NPrinting is connected to, eventually also the one used as hub destination), then, on the NPrinting Server (if Sense hub destination is used) and on each NPrinting Engine(s), to have installed 'root.cer' certificate in the Trusted Root Certification Authorities store of NPrinting Scheduler and NPrinting Engine service user account(s) (or to the Local Machine's Trusted Root Certification Authorities store).

Qlik Sense remote server certificate validation failed with SslPolicyErrors RemoteCertificateNameMismatch

Please notice that certificate subject distinguished name CN=myserver.mydomain.com and Sense server proxy address set on NPrinting QMC must be the same. This usually means to have full FQDN set as NPrinting Sense connection proxy address (and NPrinting Sense hub central node, if hub destination is used) so that it matches the subject distinguished name of the certificate.

Qlik Sense remote server certificate validation failed with SslPolicyErrors RemoteCertificateNameMismatch, RemoteCertificateChainErrors and ChainStatus with 1 element(s): [Status=UntrustedRoot, Info=A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.]

Please be sure to have exported Sense 'root.cer' certificate from Sense server QMC (this must be repeated for each Sense server NPrinting is connected to, eventually also the one used as hub destination), then, on the NPrinting Server (if Sense hub destination is used) and on each NPrinting Engine(s), to have installed 'root.cer' certificate in the Trusted Root Certification Authorities store of NPrinting Scheduler and NPrinting Engine service user account(s) (or to the Local Machine's Trusted Root Certification Authorities store). Please notice that certificate subject distinguished name CN=rd-repo26.rdlund.qliktech.com and Sense server proxy address set on NPrinting QMC must be the same. This usually means to have full FQDN set as NPrinting Sense connection proxy address (and NPrinting Sense hub central node, if hub destination is used) so that it matches the subject distinguished name of the certificate.

Updating your intranet security settings

Certain intranet settings may block connections to Qlik Sense servers. If a server is not responding, you should change the intranet settings.

Do the following:

  1. Log into the Qlik NPrinting Server using the Qlik NPrinting Domain User Service Account credentials that run the Qlik NPrinting scheduler service.

  2. Open the Windows Control Panel.
  3. Go to Internet Options.
  4. Click Change security settings.
  5. Click the Security tab.
  6. Select Local Intranet.
  7. Click the Sites button, click the Advanced button.
  8. Add all of the Qlik Sense Proxy Server computer names to the list, including the domain name: https://sense_proxy_computer_name.domain_name.
  9. Click Close.
  10. Click Ok twice to close the Internet Properties window.

  11. If the Qlik NPrinting Engine is installed on the same machine but running under a different service account, repeat the above procedures, logging in as the Service Account credentials that run the Qlik NPrinting Engine service.

  12. Repeat this process on each Qlik NPrinting Engine running the Qlik NPrinting Engine service, using the Windows Qlik NPrinting Engine services administrator.

Did this page help you?

If you find any issues with this page or its content – a typo, a missing step, or a technical error – let us know how we can improve!

Leave your feedback here