This website uses Cookies. Click Accept to agree to our website's cookie use as described in our Cookie Policy. Click Preferences to customize your cookie settings.
on - edited on by
DRay
The method in which SSL (Secure Sockets Layer) is set up has changed in Sisense V7.2. The full reference documentation is located here where each step of setting up SSL is in V7.2 and later verisons is described.
This post contains questions/symptoms with corresponding suggested solutions to these issues.
Whether your organization is upgrading from a previous version of Sisense (V7.1 or lower) or are just getting started with Sisense, the following is meant to give your organization a starting point for troubleshooting.
Topics:
404 Response
403 Response
504 Gateway Error
This page can't be displayed/This site can't be reached
The client and server don't support a common SSL protocol version or cipher suite
Another application is listening on port 443
Build Failure: Unable to verify first certificate
Resources:
Verify Configuration Settings
1. At upgrade to V7.2, was port 443 removed from the bindings of the site?
2. In the Configuration Manager (http://localhost:3030), are the following settings completed?
- Enable SSL toggled to the on position
- SSL Certificate and SSL Key populated with your uploaded certificate (or copy-pasted keys)
- Port set to 443
- Internal IP set to the domain of your organization's Sisense website
Common Issues:
404 Response:
Symptom: When we navigate to https://<host>.<domain>.com we see a 404 response
Suggested Resolution:
- If you see this on the webserver, can indicate that your SisenseWeb site has a 443 binding still in IIS and have not set up the Configuration Manager for SSL. Refer to the Setting Up SSL documentation on how to get started.
- If you are getting response when navigating to your site on a machine not on the network the Sisense webserver is on, can indicate a networking issue (outside traffic cannot reach your domain).
403 Response:
Symptom: When we navigate to https://<host>.<domain>.com we see a 403: Access Denied
Explanation: Can indicate that your Sisense webserver may still have the 443 binding attached to your Sisense website in IIS which is conflicting with the settings for SSL in the Configuration Manager.
Suggested Resolution: Remove the port 443 binding from IIS then check your setting in the Configuration Manager.
504 Gateway Error:
Symptom: When we navigate to https://localhost on the Sisense webserver, we can get to the Sisense site. But when we navigate to https://<host>.<domain>.com we see a 504: Gateway Error. We have also verified that our SSL set up is correct as described in the Verify Configuration section.
Explanation: In 7.1 and below Sisense used IIS as a web server. IIS automatically defined the firewall in Windows to allow connectivity on the ports defined. On 7.2 and above you will need to define the inbound rule to allow connectivity.
Suggested Resolution: Please follow the steps below:
- Ensure that port 443 is open on your firewall.
- If your organization is using a reverse proxy or load balancer, verify that communication with Sisense is on HTTPS.
- In some cases the request from the reverse proxy/ load balancer is communicating on HTTP with the Sisense server, in that case, change the Configuration Manager page in Sisense to work on that port without HTTPS.
- Add Node.exe from %ProgramFiles%\Sisense\app\gateway-service\node.exe as an allowed program in Windows Firewall.
This page can't be displayed/This site can't be reached:
Symptom: When we navigate to https://<host>.<domain>.com we see:
- Internet explorer: This page can't be displayed
- Chrome: This site can't be reached
- Chrome: ERR_CONNECTION_REFUSED
Explanation: Can indicate either of the following:
- There are setting changes needed in the Configuration Manager, particularly the port and Internal IP fields.
- Traffic on one or more ports that Sisense relies on are blocked on the firewall. Since SSL is no longer set up through Windows IIS, there may be ports that need to be opened to outgoing and incoming traffic.
Suggested Resolution:
- Check over your organization's settings for which port and internal IP the Sisense site is running on to verify they are accurate.
- Open Windows Firewall application on the Sisense Webserver and follow this article to open traffic both incoming and outgoing traffic on at minimum ports: 443, 8081, and whichever port your organization is running Sisense Web on.
- A more extensive list of ports to make available externally is here.
The client and server don't support a common SSL protocol version or cipher suite:
Symptom: When we navigate to https://<host>.<domain>.com we see:
- This site can’t provide a secure connection
- <host>.<domain>.com uses an unsupported protocol.
- ERR_SSL_VERSION_OR_CIPHER_MISMATCH
- Unsupported protocol
- The client and server don't support a common SSL protocol version or cipher suite.
Explanation: Can indicate any of the following:
- The certificate was not uploaded in the Configuration Manager but all other SSL settings were performed
- There is another process running on port 443
- If using a CERT and KEY file, the private key is not valid for the certificate
Suggested Resolution Steps:
- SSL Certificate field and/or the SSL Key is blank:
- Navigate to the Configuration Manager (http://localhost:3030) and verify that the SSL Certificate and the SSL Key sections. If one or both of those fields are empty then you'll need to re-upload your cert (or copy-paste the text of each document). At this time we recommend using Google Chrome to upload certificates.
- Another Process on Port 443:
- In the Configuration Manager, change the port 443 to a different port (ex. 442).
- Save the Configuration Manager and do an IIS reset on the webserver.
- Navigate to your site via the following URL: ..com:">https://<host>.<domain>.com:<port> (example: https://test.sisense.com:442)
- If you are able to successfully reach the Sisense site there is likely another process running on port 443. Please follow the steps in the Another application is listening on port 443 section.
- Other: If the above troubleshooting steps did not help, there is likely something missing in the certificate files that are necessary for web browsers to trust your certificate.
Another application is listening on port 443:
Symptom: After looking over the other errors listed in this article your organization is still seeing errors.
Suggested Solution: In some cases there are other applications running that are listening to port 443 this is the way to identify it:
- Navigate to the Configuration Manager (http://localhost:3030) and change the port to 80 and Save
- Open the Command Prompt and run netstat -aon | find ":443"
- Use the PIDs listed in CMD to match up the process names in Task Manager. Check if other application are listening to port 443 that are not Sisense.Gateway
- You can check what Service is running by opening you task manager going to Details or in Services tab and see what is the service behind the PID
- zIn case that - Open registry by entering regedit on the start menu and navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\HTTP\Parameters\UrlAclInfo you can see what Services are using that port
- You can check what Service is running by opening you task manager going to Details or in Services tab and see what is the service behind the PID
- The presence of PID 4 indicates that the System is running on 443
- Open registry by entering regedit on the start menu and navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\HTTP\Parameters\UrlAclInfo you can see what Services are using that port
- Open registry by entering regedit on the start menu and navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\HTTP\Parameters\UrlAclInfo you can see what Services are using that port
- After making sure those services are not essential for the system, stop those services.
- Once done repeat Step 2 to make sure the issue was resolved.
- Set up Sisense back to 443 in the Configuration Manager and Save. Wait a minute and try to load the website again via /">https://<host>.<domain>.com
Build Error: Unable to verify first certificate
If in the Web ECM (ECM 2.0) after setting up SSL, you see the following Build Error:
Please following the resolution instruction in the article below:
