# Cannot generate enrollment token

**URL:** <https://discuss.elastic.co/t/cannot-generate-enrollment-token/345465>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [October 20, 2023, 1:01pm UTC](https://discuss.elastic.co/t/cannot-generate-enrollment-token/345465 "2023-10-20T13:01:15Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Diego667](https://avatars.discourse-cdn.com/v4/letter/d/74df32/32.png) [@Diego667](https://discuss.elastic.co/u/Diego667)\
**Post date:** [October 20, 2023, 1:01pm UTC](https://discuss.elastic.co/t/cannot-generate-enrollment-token/345465/1 "2023-10-20T13:01:15Z")

</div>

Hello,

I'm using ELK 8.10.  
I have a working cluster composed by :

- 1 master + data node
- 1 data node

Security layer has been configured manually using those documentation :

- [TLS/SSL](https://www.elastic.co/guide/en/elasticsearch/reference/8.10/security-basic-setup.html)

- [HTTP](https://www.elastic.co/guide/en/elasticsearch/reference/8.10/security-basic-setup-https.html)

I did not entered any password while configuring certificates.

Now I want to add a new data node. I'm trying to generate a enrollment token using `elasticsearch-create-enrollment-token -s node` but I get this error :

`Elasticsearch node HTTP layer SSL configuration Keystore doesn’t contain any PrivateKey entries where the associated certificate is a CA certificate`

Tried to follow this this [fix](https://discuss.elastic.co/t/import-ca-cert-as-privatekeyentry-to-http-keystore-solve-unable-to-create-enrollment-token-error/313780) but keytool ask me for a password I did not set up for my certificates (I put blank everywhere for test)

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [October 20, 2023, 2:25pm UTC](https://discuss.elastic.co/t/cannot-generate-enrollment-token/345465/2 "2023-10-20T14:25:03Z")

</div>

Hi @Diego667 Welcome to the community

Take a look at this. I think it'll help

> [@Elasticsearch-create-enrollment-token is not possible without a keystore ( aka with PEM certificates)](https://discuss.elastic.co/t/elasticsearch-create-enrollment-token-is-not-possible-without-a-keystore-aka-with-pem-certificates/336136/2):
>
> Hi @DavidDPD Welcome to the community, and apologies for the frustrating experience. Yes a bit frustrating and probably could be documented better. I think perhaps there is a fundamental "disconnect" At least this is how I understand it.... When you want to use your own certs etc, you are no longer using security auto configuration and thus when you use your own certs you should no longer be trying to "enroll" another node in the cluster using an enrollment token... the elasticsearch-create-…

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 17, 2023, 2:25pm UTC](https://discuss.elastic.co/t/cannot-generate-enrollment-token/345465/3 "2023-11-17T14:25:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.