# Creating http.p12,tranport.p12 from a signed CSR for Elasticsearch **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [November 23, 2022, 6:57pm UTC](https://discuss.elastic.co/t/creating-http-p12-tranport-p12-from-a-signed-csr-for-elasticsearch/319680 "2022-11-23T18:57:43Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![redsearch2022](https://avatars.discourse-cdn.com/v4/letter/r/e9a140/32.png) [@redsearch2022](https://discuss.elastic.co/u/redsearch2022)\ **Post date:** [November 23, 2022, 6:57pm UTC](https://discuss.elastic.co/t/creating-http-p12-tranport-p12-from-a-signed-csr-for-elasticsearch/319680/1 "2022-11-23T18:57:43Z")
After getting the CSR signed, how do I create the http.p12 and transport.p12 needed for Elasticsearch ```auto xpack.security.http.ssl: enabled: true keystore.path: certs/http.p12 xpack.security.transport.ssl: enabled: true verification_mode: certificate keystore.path: certs/transport.p12 truststore.path: certs/transport.p12 ``` [Set up basic security for the Elastic Stack plus secured HTTPS traffic | Elasticsearch Guide [8.5] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-basic-setup-https.html) ##### Sign certificates with a central CA[edit](https://github.com/elastic/elasticsearch/edit/8.5/x-pack/docs/en/security/securing-communications/security-basic-setup-https.asciidoc) If you work in an environment with a central security team, they can likely generate a certificate for you. Infrastructure within your organization might already be configured to trust an existing CA, so it may be easier for clients to connect to Elasticsearch if you use a CSR and send that request to the team that controls your CA. To use a central CA, answer `y` to the first question. ---
**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\ **Post date:** [November 24, 2022, 5:16am UTC](https://discuss.elastic.co/t/creating-http-p12-tranport-p12-from-a-signed-csr-for-elasticsearch/319680/2 "2022-11-24T05:16:05Z")
The documentation you linked is for configuring TLS for the HTTP interface, i.e. it is for settings begin with `xpack.security.http.ssl.XXX`. You probably want to re-evaluate whether you want to apply the same certs/keys for the transport interface. You can generate the p12 file from PEM format private key and signed cert in different ways. One of them is to use the standard `openssl` tool with a command like: ```auto openssl pkcs12 -export -in SIGNED_CERT_FILE -inkey PRIVATE_KEY_FILE -out http.p12 ``` Alternatively, you don't have to use p12 files since ES can take PEM files as well with settings: ```auto xpack.security.http.ssl.key: PRIVATE_KEY_FILE xpack.security.http.ssl.certificate: SIGNED_CERT_FILE ``` ---
**Author:** ![redsearch2022](https://avatars.discourse-cdn.com/v4/letter/r/e9a140/32.png) [@redsearch2022](https://discuss.elastic.co/u/redsearch2022)\ **Post date:** [November 24, 2022, 2:15pm UTC](https://discuss.elastic.co/t/creating-http-p12-tranport-p12-from-a-signed-csr-for-elasticsearch/319680/3 "2022-11-24T14:15:13Z")
Thank you for your help, I was able to get Elasticsearch running, but when I tried to created an enrollment token for another node, I get the error below. Is it the problem with the certificate, not finding the hostname or the IP address. The log has been modified to removed personal information. ```auto $ sudo /usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s node 13:57:16.246 [main] WARN org.elasticsearch.common.ssl.DiagnosticTrustManager - failed to establish trust with server at [10.*.*.106]; the server provided a certificate with subject name [CN=*.demo.ca,OU=ADM-IM/JDCP,O=ND-DN Cloud Intranet,L= ***wa,ST=*** io,C=CA], fingerprint [f3c ************* 4ed6f], keyUsage [digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment] and extendedKeyUsage [serverAuth]; the session uses cipher suite [TLS_AES_256_GCM_SHA384] and protocol [TLSv1.3]; the certificate has subject alternative names [DNS:*.demo.ca,DNS:demo.ca,DNS:*.cloud.demo.ca]; the certificate is issued by [CN=example-CA-Authority] but the server did not provide a copy of the issuing certificate in the certificate chain; this ssl context ([xpack.security.http.ssl (with trust configuration: Composite-Trust{JDK-trusted-certs,PEM-trust{/etc/elasticsearch/certs/*base64.cer}})]) is not configured to trust that issuer but trusts [90] other issuers java.security.cert.CertificateException: No subject alternative names matching IP address 10.*.*.106 found ``` ---
**Author:** ![redsearch2022](https://avatars.discourse-cdn.com/v4/letter/r/e9a140/32.png) [@redsearch2022](https://discuss.elastic.co/u/redsearch2022)\ **Post date:** [November 24, 2022, 5:19pm UTC](https://discuss.elastic.co/t/creating-http-p12-tranport-p12-from-a-signed-csr-for-elasticsearch/319680/4 "2022-11-24T17:19:44Z")
I was able to get rid of the error with adding "xpack.security.http.ssl.verification\_mode: certificate" now having a different error message. How would I created a keystore for the configuration. ```auto $ sudo /usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s node Unable to create enrollment token for scope [node] ERROR: Unable to create an enrollment token. Elasticsearch node HTTP layer SSL configuration is not configured with a keystore ``` ```auto xpack.security.http.ssl.enabled: true xpack.security.http.ssl.verification_mode: certificate xpack.security.http.ssl.key: certs/demo.key xpack.security.http.ssl.certificate: certs/demo.cer #xpack.security.http.ssl.certificate_authorities: ["certs/??????"] xpack.security.transport.ssl.enabled: true xpack.security.transport.ssl.verification_mode: certificate xpack.security.transport.ssl.key: certs/demo.key xpack.security.transport.ssl.certificate: certs/demo.cer #xpack.security.transport.ssl.certificate_authorities: ["certs/???????"] ``` ---
**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\ **Post date:** [November 27, 2022, 11:28pm UTC](https://discuss.elastic.co/t/creating-http-p12-tranport-p12-from-a-signed-csr-for-elasticsearch/319680/5 "2022-11-27T23:28:57Z")
The enrollment token was designed to work with [auto-configured security](https://www.elastic.co/guide/en/elasticsearch/reference/current/configuring-stack-security.html). It is possible to get it work with manually configured security. But you'll have to understand the details. The current problem you are having is that generating enrollment token expects the HTTP TLS configuration to be configured with keystore, not pem files. So you need create the pkcs12 files. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 25, 2022, 11:29pm UTC](https://discuss.elastic.co/t/creating-http-p12-tranport-p12-from-a-signed-csr-for-elasticsearch/319680/6 "2022-12-25T23:29:50Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.