# Cannot create an enrollment token to enrol a new elasticsearch node

**URL:** https://discuss.elastic.co/t/cannot-create-an-enrollment-token-to-enrol-a-new-elasticsearch-node/363697
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [July 24, 2024, 10:51am UTC](https://discuss.elastic.co/t/cannot-create-an-enrollment-token-to-enrol-a-new-elasticsearch-node/363697 "2024-07-24T10:51:51Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![adrian.cunnelly](https://avatars.discourse-cdn.com/v4/letter/a/8e7dd6/32.png) [@adrian.cunnelly](https://discuss.elastic.co/u/adrian.cunnelly)
#### Post date: [July 24, 2024, 10:51am UTC](https://discuss.elastic.co/t/cannot-create-an-enrollment-token-to-enrol-a-new-elasticsearch-node/363697/1 "2024-07-24T10:51:51Z")

</div>

I have an elasticsearch 8.14 cluster running with 5 nodes with security enabled using own generated certificates. Everything is running fine but I now need to add 2 ingest only nodes. I am trying to create the enrollment token with:

`/usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s node`

But this is failing with:

`ERROR: Unable to create an enrollment token. Elasticsearch node HTTP layer SSL configuration Keystore doesn't contain any PrivateKey entries where the associated certificate is a CA certificate, with exit code 73`

Any ideas ?

---

<div class="post-metadata">

### Author: ![adrian.cunnelly](https://avatars.discourse-cdn.com/v4/letter/a/8e7dd6/32.png) [@adrian.cunnelly](https://discuss.elastic.co/u/adrian.cunnelly)
#### Post date: [July 24, 2024, 12:50pm UTC](https://discuss.elastic.co/t/cannot-create-an-enrollment-token-to-enrol-a-new-elasticsearch-node/363697/2 "2024-07-24T12:50:34Z")

</div>

Panic over 🙂

I have resolved this, the http.p12 keystore didn't contain the private key for the CA. I have added the private key and can now generate enrollment tokens