Qlik Sense Logging Service does not have support for SSL Database traffic encryption

[Sonja_Bauernfeind]

Centralized logging has been deprecated with the Qlik Sense Enterprise on Windows May 2021 release. This article is only valid for previous versions. No support can be provided on Qlik Centralized logging as all Qlik Sense versions using it have reached end of life. 

When Database traffic encryption is enabled the Qlik Sense Logging service will not function. When Service is started the service will stop with a 1064 error. 

For related information please see Qlik Sense - Setting up database traffic encryption

This is working as designed. The Qlik Sense Logging service is stopping due to it trying to communicate to a database and failing as the database was configured to accept only encrypted traffic. The centralize logging connection string is missing the "Ssl Mode=Require". Traffic then is unencrypted and as result it is rejected by the database and the service reaction is to fail to start with the 1064 error. 

Currently there is no way to modify the connection string from the centralize logging, other than keeping it in cleartext. 

Workaround:

NOTE! The workaround consists of adding encryption to the database connection by making the centralize logging connection string appear in cleartext.

1. Go to %Program Files%\Qlik\Sense\Repository\Util\QlikSenseUtil.
2. Open QlikSenseUtil.exe as Admin (right-lick > run as administrator)
3. In QlikSenseUtil.exe > select "Connection String Editor".
4. In the file path to config file, place:
   
    C:\ProgramData\Qlik\Sense\Log\QlikCentralizedLogging.config
   
   Before making any changes backup file "QlikCentralizedLogging.config" file.
   
   
5. Take the unencrypted connection string.
6. Open notepad as administrator.
7. Navigate and open C:\ProgramData\Qlik\Sense\Log\QlikCentralizedLogging.config
8. Find and remove "<connectionStrings configProtectionProvider="DataProtectionConfigurationProvider"> "  all the way to " </connectionStrings>" 
9. Now on the same location add the unencrypted connection string ( including the " <connectionStrings>" and  "</connectionStrings>" ) .
10. Add Ssl Mode=Require.
    
    For example, step 9 and 10:
    
    

    <connectionStrings>
    <add name="qlogs_reader" connectionString="user id=qlogs_reader;password=123;host=qlikmachine;port=4432;database=QLogs;Ssl Mode=Require;" providerName="Devart.Data.PostgreSql" />
    <add name="qlogs_writer" connectionString="user id=qlogs_writer;password=123;host=qlikmachine;port=4432;database=QLogs;Ssl Mode=Require;" providerName="Devart.Data.PostgreSql" />
    </connectionStrings>​

11. Save the file.
12. Now start the Qlik Logging Service.