# Cant create enrollment token with own certificates

**URL:** https://discuss.elastic.co/t/cant-create-enrollment-token-with-own-certificates/308629
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [July 1, 2022, 6:53am UTC](https://discuss.elastic.co/t/cant-create-enrollment-token-with-own-certificates/308629 "2022-07-01T06:53:23Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![d\_raulf](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/d_raulf/32/107798_2.png) [@d\_raulf](https://discuss.elastic.co/u/d_raulf)
#### Post date: [July 1, 2022, 6:53am UTC](https://discuss.elastic.co/t/cant-create-enrollment-token-with-own-certificates/308629/1 "2022-07-01T06:53:23Z")

</div>

Hey,

I'm trying to run Elasticsearch with our own CA. Key and Cert are provide by our PKI-Team.

Changes in elasticsearch.yml:

```auto
network.host: 0.0.0.0

xpack.security.http.ssl:
  enabled: true
  keystore.path: certs/<keystore>.jks

xpack.security.transport.ssl:
  enabled: true
  verification_mode: certificate
  keystore.path: certs/<keystore>.jks
  truststore.path: certs/<keystore>.jks

```

After change config, i have run:

```auto
/usr/share/elasticsearch/bin/elasticsearch-keystore add xpack.security.transport.ssl.truststore.secure_password
/usr/share/elasticsearch/bin/elasticsearch-keystore add xpack.security.transport.ssl.keystore.secure_password
/usr/share/elasticsearch/bin/elasticsearch-keystore add xpack.security.transport.ssl.truststore.secure_password

systemctl restart elasticsearch.service

curl --cacert <chainfile -u elastic 'https://<name>:9200/_cat/nodes?v'

Enter host password for user 'elastic':
ip heap.percent ram.percent cpu load_1m load_5m load_15m node.role master name
<ip> 3 75 0 0.00 0.00 0.00 cdfhilmrstw * <name>

```

If I want to generate a registration token with following command:

```auto
/usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s node --url https://<name>:9200

```

i get the error:

```auto
ERROR: Unable to create an enrollment token. Elasticsearch node HTTP layer SSL configuration Keystore doesn't contain any PrivateKey entries where the associated certificate is a CA certificate

```

Documentation says:

```auto
elasticsearch-create-enrollment-token can only be used with Elasticsearch clusters that have been auto-configured for security.

```

How can i generate an enrollment token with our own certificates?

---

<div class="post-metadata">

### Author: ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)
#### Post date: [July 2, 2022, 9:10pm UTC](https://discuss.elastic.co/t/cant-create-enrollment-token-with-own-certificates/308629/2 "2022-07-02T21:10:27Z")

</div>

You can’t, but you don’t _have to_ . You can very well configure your nodes manually by following the documentation and using your team provided keys/certificates

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 30, 2022, 9:10pm UTC](https://discuss.elastic.co/t/cant-create-enrollment-token-with-own-certificates/308629/3 "2022-07-30T21:10:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.