# Add new node in ES cluster **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [February 2, 2020, 1:51pm UTC](https://discuss.elastic.co/t/add-new-node-in-es-cluster/217529 "2020-02-02T13:51:31Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![bdn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bdn/32/136737_2.png) [@bdn](https://discuss.elastic.co/u/bdn)\ **Post date:** [February 2, 2020, 1:51pm UTC](https://discuss.elastic.co/t/add-new-node-in-es-cluster/217529/1 "2020-02-02T13:51:32Z")
Previously, I generated certificates for my ES nodes through the below command. > /usr/share/elasticsearch/bin/elasticsearch-certutil cert ca --pem --in /tmp/instance.yml --out /root/new/new\_cert.zip Now I want to add a new node by defining the previous CA certificate but it's not working. > /usr/share/elasticsearch/bin/elasticsearch-certutil cert --ca /root/new/ca/ca.crt --name node-04 --dns node-04 --ip 172.16.0.1 Here is the error log. > Exception in thread "main" java.io.IOException: toDerInputStream rejects tag type 45 > at java.base/sun.security.util.DerValue.toDerInputStream(DerValue.java:858) > at java.base/sun.security.pkcs12.PKCS12KeyStore.engineLoad(PKCS12KeyStore.java:1982) > at java.base/sun.security.util.KeyStoreDelegator.engineLoad(KeyStoreDelegator.java:222) > at java.base/java.security.KeyStore.load(KeyStore.java:1472) > at org.elasticsearch.xpack.core.ssl.CertParsingUtils.readKeyStore(CertParsingUtils.java:76) > at org.elasticsearch.xpack.core.ssl.CertParsingUtils.readPkcs12KeyPairs(CertParsingUtils.java:135) > at org.elasticsearch.xpack.security.cli.CertificateTool$CertificateCommand.lambda$loadPkcs12CA$1(CertificateTool.java:341) > at org.elasticsearch.xpack.security.cli.CertificateTool.withPassword(CertificateTool.java:932) > at org.elasticsearch.xpack.security.cli.CertificateTool.access$100(CertificateTool.java:85) > at org.elasticsearch.xpack.security.cli.CertificateTool$CertificateCommand.loadPkcs12CA(CertificateTool.java:340) > at org.elasticsearch.xpack.security.cli.CertificateTool$CertificateCommand.getCAInfo(CertificateTool.java:328) > at org.elasticsearch.xpack.security.cli.CertificateTool$GenerateCertificateCommand.execute(CertificateTool.java:684) > at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86) > at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:125) > at org.elasticsearch.cli.MultiCommand.execute(MultiCommand.java:77) > at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:125) > at org.elasticsearch.cli.Command.main(Command.java:90) > at org.elasticsearch.xpack.security.cli.CertificateTool.main(CertificateTool.java:137) ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [February 4, 2020, 1:48pm UTC](https://discuss.elastic.co/t/add-new-node-in-es-cluster/217529/2 "2020-02-04T13:48:24Z")
See [our documentation](https://www.elastic.co/guide/en/elasticsearch/reference/current/certutil.html): `--ca` : Specifies the path to an existing CA key pair (in PKCS#12 format). This parameter cannot be used with the `ca` or `csr` parameters. You, on the other hand, are passing in a certificate in PEM format, and the tool is throwing an error. You need to pass `--ca-cert /root/new/ca/ca.crt --ca-key /root/new/ca/ca.key` in the command above ---
**Author:** ![bdn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bdn/32/136737_2.png) [@bdn](https://discuss.elastic.co/u/bdn)\ **Post date:** [February 4, 2020, 2:10pm UTC](https://discuss.elastic.co/t/add-new-node-in-es-cluster/217529/3 "2020-02-04T14:10:47Z")
`ca.key` file was not generated earlier that's why I'm having difficulties to sign a new node from an existing CA. There is only `ca.crt` file in `ca` folder. ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [February 4, 2020, 2:15pm UTC](https://discuss.elastic.co/t/add-new-node-in-es-cluster/217529/4 "2020-02-04T14:15:35Z")
Apologies, I misread your original command ```auto /usr/share/elasticsearch/bin/elasticsearch-certutil cert ca --pem --in /tmp/instance.yml --out /root/new/new_cert.zip ``` I guess you mean ```auto /usr/share/elasticsearch/bin/elasticsearch-certutil cert --pem --in /tmp/instance.yml --out /root/new/new_cert.zip ``` as you can't pass both `ca` and `cert` in the same invocation. Unfortunately when you run `cert` and you don't specify the CA yourself, the tool generates one on the fly for you and does _not_ keep the CA key around, unless you tell it to do so with `--keep-ca-key`. In essence, you have no way to create new certificates that are signed by the same CA as the one that has signed the existing nodes' certificates as you are missing the CA key. You would need to recreate a CA and use that to sign new certificates for all your nodes and the one for your new node. ---
**Author:** ![bdn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bdn/32/136737_2.png) [@bdn](https://discuss.elastic.co/u/bdn)\ **Post date:** [February 8, 2020, 5:53am UTC](https://discuss.elastic.co/t/add-new-node-in-es-cluster/217529/5 "2020-02-08T05:53:08Z")
Thank you for your guidance. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 7, 2020, 5:53am UTC](https://discuss.elastic.co/t/add-new-node-in-es-cluster/217529/6 "2020-03-07T05:53:10Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.