Could not Install the Certificate Package error when adding a RIM node

[Andrew_Delaney]

Adding a Rim node fails with the following error:

Could not install the certificate package. Try again or check the log for details.

Review the following log file for additional error information: %ProgramData%\Qlik\Sense\Logs\Repository\Trace 

1. Duplicate or invalid root certificate 

213    20161212T154148.500+0200    ERROR    LABQV    System.Repository.Repository.Core.Certificates.CertificatePasswordVerificationWebService    21    759d16bb-c7cc-46fd-b733-ecde7c504993    NT AUTHORITY\SYSTEM    An error occured when installing certificate package. Qlik.Sense.Communication.Security.Exceptions.SafeSecureException: Duplicate or invalid root certificates are not allowed; see logs??   at Qlik.Sense.Communication.Security.CertSetup.ThrowAndLogFatalRootError(String msg)??   at Qlik.Sense.Common.Security.Certificates.CertCreator.InstallCert(DotNetCert newCert)??   at Qlik.Sense.Common.Security.SecuritySetup.InstallSecurity(DotNetCert root, DotNetCert service, DotNetCert client)??   at Repository.Core.Certificates.CertificatePasswordVerificationWebService.HandleRequest(IHttpListenerRequestWrapper httpRequest, IHttpListenerResponseWrapper httpResponse)                759d16bb-c7cc-46fd-b733-ecde7c504993

To resolve:

This indicates that the system already has a root certificate in place that needs to be removed before new ones can be installed.

Remove any preexisting Qlik Sense certificates from the rim node. For instructions on how to do this refer to How to recreate or just delete certificates in Qlik Sense.

If you do not use Database Encryption (link), removing the certificates from the rim node can be safely done. Even so, always back up the certificates before proceeding.

2. Certificate of type Service was not valid

20190223T014326.849-0500    ERROR    US1SXWN00563    System.Repository.Repository.Core.Certificates.CertificatePasswordVerificationWebService    20    83bfea24-27b9-4291-8b1a-b831e4c15c83    WMSERVICE\gfa82744    An error occured when installing certificate package. System.ArgumentException: Certificate of type Service was not valid!↵↓   at Qlik.Sense.Common.Security.SecuritySetup.CheckCert(DotNetCert signingCert, DotNetCert cert, CertType type)↵↓   at Qlik.Sense.Common.Security.SecuritySetup.InstallSecurity(DotNetCert root, DotNetCert service, DotNetCert client)↵↓   at Repository.Core.Certificates.CertificatePasswordVerificationWebService.HandleRequest(IHttpListenerRequestWrapper httpRequest, IHttpListenerResponseWrapper httpResponse, IHttpRecording httpRecording)                83bfea24-27b9-4291-8b1a-b831e4c15c83

To resolve:

1. Make sure service account has local Admin Right.
2. Make sure the service account has the right to all Qlik folders. (Check the user is having rights on related folders)
3. Make sure that the service account has the right to C:\ProgramData\Microsoft\Crypto folders. (Provide full control to service account)
4. Reboot the server
5. Make sure that the main security policies are disabled:
   1. System Cryptography: Force strong key protection for user keys stored on the computer (It was enabled in the customer's environment ) 
   2. System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing.
   3. All "Public Key Policies" are disabled. ( Security Settings > Public Key Policies).
6. Check if some TLS disabled (1.2, 1.0, SSL 3.0)
7. Try manually add the certificates.
8. Uninstall the RIM node and reinstall, i fissue persists, proceed to next step
9. Test by adding another RIM nodes and see if that works or get the same issue just to mitigate that issue is not with the central server.

Follow all the steps in the sequence mentioned above and then disable the Cryptography policies.

Related Content:

Incorrect password error received when adding a Qlik Sense Rim node 
Error when adding rim node to new Qlik Sense install 

Environment:

Qlik Sense Enterprise on Windows