Upgrading the certificate signing algorithm

Qlik Sense installations generate SHA-256 certificates by default. However, administrators have the option to upgrade the certificate to SHA-384. The upgrade is controlled by the following parameters in the repository configuration file:

CertificateUpgrade.Enabled (default value: False)
Certificate.SignatureAlgorithm (default value: SHA384WITHRSA).

Upgrading a certificate algorithm to SHA-384

Before you start the upgrade, create a backup of the certificates. For more information, see Backing up certificates.

Do the following:

Log in to Qlik Sense using the service account credentials.
Go to C:\Program Files\Qlik\Sense\Repository\ and open the file Repository.exe.config.
Set the value of CertificateUpgrade.Enabled to true.
Stop the following Qlik Sense services:
- Qlik Sense Repository Service
- Qlik Sense Printing Service
- Qlik Sense Scheduler Service
- Qlik Sense Engine Service
- Qlik Sense Proxy Service
On the central node, run the Qlik Sense Repository Service in bootstrap mode.
For more information about the Qlik Sense services, see Services.
1. Open a command prompt as an administrator and navigate to C:\Program Files\Qlik\Sense\Repository.
2. Run the following command: Repository.exe -bootstrap -iscentral
3. After successful completion, the following message is displayed: "Entering main startup phase"
4. Restart the Qlik Sense Service Dispatcher.
5. Wait for the massage "Bootstrap mode has terminated. Press ENTER to exit".
Start the Qlik Sense services.

If the services are started manually, start them in the following order:
- Qlik Sense Repository Service
- Qlik Sense Printing Service
- Qlik Sense Scheduler Service
- Qlik Sense Engine Service
- Qlik Sense Proxy Service

If Qlik NPrinting is connected to the Qlik Sense server, you need to export the certificates to the NPrinting deployment and restart the NPrinting services.

Installations with rim nodes

If your installation includes rim nodes, you need to redistribute the certificates to all nodes.

Do the following:

Delete the certificates following the steps described in Qlik Community: How to recreate or just delete certificates in Qlik Sense - No access to QMC or Hub.
Redistribute the certificates to each node following the steps in Redistributing a certificate.
To verify the distributed certificates, open the Microsoft Management Console (MMC). Refresh the pages with personal certificates and trusted root certificates to view the correct certificate information.

Qlik Sense multi-cloud deployments

For Qlik Sense multi-cloud deployments, do the following:

Navigate to Cloud distribution > Deployment setup.
Delete and re-add any existing deployments, following the steps described in Distributing apps to Qlik Cloud.

For more information, see in Qlik Community: How to recreate or just delete certificates in Qlik Sense - No access to QMC or Hub.

Downgrading a certificate algorithm to SHA-256

Before you start the upgrade, create a backup of the certificates. For more information, see Backing up certificates.

Do the following:

Log in to Qlik Sense using the service account credentials.
Go to C:\Program Files\Qlik\Sense\Repository\ and open the file Repository.exe.config.
Set the value of CertificateUpgrade.Enabled to true.
Set the value of Certificate.SignatureAlgorithm to SHA256WITHRSA.
Stop the following Qlik Sense services:
- Qlik Sense Repository Service
- Qlik Sense Printing Service
- Qlik Sense Scheduler Service
- Qlik Sense Engine Service
- Qlik Sense Proxy Service
On the central node, run the Qlik Sense Repository Service in bootstrap mode.
For more information about the Qlik Sense services, see Services.
1. Open a command prompt as an administrator and navigate to C:\Program Files\Qlik\Sense\Repository.
2. Run the following command: Repository.exe -bootstrap -iscentral
3. After successful completion, the following message is displayed: "Entering main startup phase"
4. Restart the Qlik Sense Service Dispatcher.
5. Wait for the massage "Bootstrap mode has terminated. Press ENTER to exit".
Start the Qlik Sense Repository Service followed by the other Qlik Sense services.

If Qlik NPrinting is connected to the Qlik Sense server, you need to export the certificates to the NPrinting deployment and restart the NPrinting services.

Installations with rim nodes

If your installation includes rim nodes, you need to redistribute the certificates to all nodes.

Do the following:

Delete the certificates following the steps described in Qlik Community: How to recreate or just delete certificates in Qlik Sense - No access to QMC or Hub.
Redistribute the certificates to each node following the steps in Redistributing a certificate.
To verify the distributed certificates, open the Microsoft Management Console (MMC). Refresh the pages with personal certificates and trusted root certificates to view the correct certificate information.

Qlik Sense multi-cloud deployments

For Qlik Sense multi-cloud deployments, do the following:

Navigate to Cloud distribution > Deployment setup.
Delete and re-add any existing deployments, following the steps described in Distributing apps to Qlik Cloud.

For more information, see in Qlik Community: How to recreate or just delete certificates in Qlik Sense - No access to QMC or Hub.

Did this page help you?

If you find any issues with this page or its content – a typo, a missing step, or a technical error – let us know how we can improve!

Leave your feedback here