Cannot generate enrollment token

[Diego667]

Hello,

I'm using ELK 8.10.
I have a working cluster composed by :

• 1 master + data node
• 1 data node

Security layer has been configured manually using those documentation :

• TLS/SSL

• HTTP

I did not entered any password while configuring certificates.

Now I want to add a new data node. I'm trying to generate a enrollment token using elasticsearch-create-enrollment-token -s node but I get this error :

Elasticsearch node HTTP layer SSL configuration Keystore doesn’t contain any PrivateKey entries where the associated certificate is a CA certificate

Tried to follow this this fix but keytool ask me for a password I did not set up for my certificates (I put blank everywhere for test)

[stephenb (Stephen Brown)]

Hi @Diego667 Welcome to the community

Take a look at this. I think it'll help

Elasticsearch-create-enrollment-token is not possible without a keystore ( aka with PEM certificates)

Hi @DavidDPD Welcome to the community, and apologies for the frustrating experience. Yes a bit frustrating and probably could be documented better. I think perhaps there is a fundamental "disconnect" At least this is how I understand it.... When you want to use your own certs etc, you are no longer using security auto configuration and thus when you use your own certs you should no longer be trying to "enroll" another node in the cluster using an enrollment token... the elasticsearch-create-…