# Create enrollment for kibana impossible with certificate Lets Encript
**URL:** https://discuss.elastic.co/t/create-enrollment-for-kibana-impossible-with-certificate-lets-encript/317294
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [October 24, 2022, 7:13am UTC](https://discuss.elastic.co/t/create-enrollment-for-kibana-impossible-with-certificate-lets-encript/317294 "2022-10-24T07:13:43Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@abkrim](https://discuss.elastic.co/u/abkrim)
#### Post date: [October 24, 2022, 7:13am UTC](https://discuss.elastic.co/t/create-enrollment-for-kibana-impossible-with-certificate-lets-encript/317294/1 "2022-10-24T07:13:43Z")
After the problem I indicated in the post [I can't get Elastic and Kibana to work with real certificates](https://discuss.elastic.co/t/i-cant-get-elastic-and-kibana-to-work-with-real-certificates/317282/6) I was finally able to understand the issue of needing to pass the --url in the command.
But now when I want to generate the renrollmemnt of kibana, a new error, which I am not able to get out of and from which I see a lot of literature, but it does not adapt to the situation.
```auto
root@elk2:~# systemctl restart elasticsearch.service && systemctl restart kibana
root@elk2:~# /usr/share/elasticsearch/bin/elasticsearch-reset-password -u elastic -url https://elk2.mydomain.ovh:9200 -vvv
Unexpected http status [401] while attempting to determine cluster health. Will retry at most 5 more times.
This tool will reset the password of the [elastic] user to an autogenerated value.
The password will be printed in the console.
Please confirm that you would like to continue [y/N]y
Password for the [elastic] user successfully reset.
New value: SoMePa$$w0rd
root@elk2:~# /usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana --url https://elk2.mydomain.ovh:9200 -vvvv
Unexpected http status [401] while attempting to determine cluster health. Will retry at most 5 more times.
Unable to create enrollment token for scope [kibana]
ERROR: Unable to create an enrollment token. Elasticsearch node HTTP layer SSL configuration is not configured with a keystore
```
## Log elastic
```auto
[2022-10-24T07:05:34,618][INFO][o.e.x.s.a.f.FileUserPasswdStore] [elk2] users file [/etc/elasticsearch/users] changed. updating users...
[2022-10-24T07:05:34,620][INFO][o.e.x.s.a.f.FileUserRolesStore] [elk2] users roles file [/etc/elasticsearch/users_roles] changed. updating users roles...
```
## Config elastic
```auto
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
network.host: elk2.endesarrollo.ovh
xpack.security.enabled: true
xpack.security.enrollment.enabled: true
xpack.security.http.ssl:
enabled: true
key: certs/privkey.pem
certificate: certs/fullchain.pem
certificate_authorities: [
"certs/fullchain.pem",
"certs/cacert.x1.pem",
]
xpack.security.transport.ssl:
enabled: true
verification_mode: certificate
#client_authentication: required
key: certs/privkey.pem
certificate: certs/fullchain.pem
certificate_authorities: [
"certs/fullchain.pem",
"certs/cacert.x1.pem",
]
cluster.initial_master_nodes: ["elk2.endesarrollo.ovh"]
http.host: 0.0.0.0
```
Apreciate help.
---
### Author:  [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)
#### Post date: [October 27, 2022, 12:16am UTC](https://discuss.elastic.co/t/create-enrollment-for-kibana-impossible-with-certificate-lets-encript/317294/2 "2022-10-27T00:16:03Z")
> [@abkrim](#):
>
> `ERROR: Unable to create an enrollment token. Elasticsearch node HTTP layer SSL configuration is not configured with a keystore`
The error means you need configure your HTTP TLS with a keystore instead of PEM files, specifically, replacing
```auto
xpack.security.http.ssl:
enabled: true
key: certs/privkey.pem
certificate: certs/fullchain.pem
```
With something like
```auto
xpack.security.http.ssl:
enabled: true
keystore.path: certs/http.p12
```
where `http.p12` is a pkcs12 file that contains server's private key and cert. Because of [this bug](https://github.com/elastic/elasticsearch/issues/89017), generating Kibana enrollment token also requires the CA key to be present in the keystore, which may not be possible if you are using a public CA. If that's the case, you'll have to manually configure Kibana
---
### Author:  [@abkrim](https://discuss.elastic.co/u/abkrim)
#### Post date: [October 27, 2022, 5:11am UTC](https://discuss.elastic.co/t/create-enrollment-for-kibana-impossible-with-certificate-lets-encript/317294/3 "2022-10-27T05:11:38Z")
My issue is not with the self-signed certificates by Elasticseacrh, but with the ones signed by let's encrypt. In fact, the configuration that I indicate has nothing to do with self-signed certificates.
All the best.
---
### Author:  [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)
#### Post date: [October 27, 2022, 6:54am UTC](https://discuss.elastic.co/t/create-enrollment-for-kibana-impossible-with-certificate-lets-encript/317294/4 "2022-10-27T06:54:42Z")
I think there are some misunderstandings. The `certs/http.p12` is merely a placeholder name. It does not mean self-signed certificate. What you need to do is create such a pkcs file (with a tool like OpenSSL or keytool) by importing your own private key and cert singed by letsencypt. You can name the file however you want.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 24, 2022, 6:55am UTC](https://discuss.elastic.co/t/create-enrollment-for-kibana-impossible-with-certificate-lets-encript/317294/5 "2022-11-24T06:55:41Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.