# How to add new node to Elasticsearch cluster with Https

**URL:** <https://discuss.elastic.co/t/how-to-add-new-node-to-elasticsearch-cluster-with-https/322942>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [January 11, 2023, 2:51pm UTC](https://discuss.elastic.co/t/how-to-add-new-node-to-elasticsearch-cluster-with-https/322942 "2023-01-11T14:51:56Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![makkaroni8](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/makkaroni8/32/108854_2.png) [@makkaroni8](https://discuss.elastic.co/u/makkaroni8)\
**Post date:** [January 11, 2023, 2:51pm UTC](https://discuss.elastic.co/t/how-to-add-new-node-to-elasticsearch-cluster-with-https/322942/1 "2023-01-11T14:51:56Z")

</div>

Hi,

I'm using a single-node Elasticsearch instance.  
I want to add another node to my cluster by Enrolling the new node. But I have the same Issue:  
[ERROR: Failed to determine the health of the cluster with elasticsearch-create-enrollment-token](https://discuss.elastic.co/t/error-failed-to-determine-the-health-of-the-cluster-with-elasticsearch-create-enrollment-token/297041).

How can I add another node to the Cluster? I found no outer method to do that.  
Or how can I change my configuration?

Her is the security part of the config from the existing node(cluster).

```auto
xpack.security.enabled: true
#xpack.monitoring.collection.enabled: true
xpack.security.enrollment.enabled: true

# Enable encryption for HTTP API client connections, such as Kibana, Logstash, and Agents
xpack.security.http.ssl:
  enabled: true
  key: certs/xxxx.key
  certificate: certs/xxxx.cer
# keystore.path: certs/http.p12

# Enable encryption and mutual authentication between cluster nodes
xpack.security.transport.ssl:
  enabled: true
  verification_mode: certificate
  key: certs/xxxx.key
  certificate: certs/xxxx.cer

```

---

<div class="post-metadata">

**Author:** ![Ayush\_Mathur](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ayush_mathur/32/77134_2.png) [@Ayush\_Mathur](https://discuss.elastic.co/u/Ayush_Mathur)\
**Post date:** [January 11, 2023, 3:14pm UTC](https://discuss.elastic.co/t/how-to-add-new-node-to-elasticsearch-cluster-with-https/322942/2 "2023-01-11T15:14:19Z")

</div>

Have you added the required configuration properties to make your single node cluster to n-node cluster? Please follow: [Start the Elastic Stack with security enabled automatically | Elasticsearch Guide [8.6] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/8.6/configuring-stack-security.html#stack-enroll-nodes)

---

<div class="post-metadata">

**Author:** ![makkaroni8](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/makkaroni8/32/108854_2.png) [@makkaroni8](https://discuss.elastic.co/u/makkaroni8)\
**Post date:** [January 13, 2023, 1:03pm UTC](https://discuss.elastic.co/t/how-to-add-new-node-to-elasticsearch-cluster-with-https/322942/3 "2023-01-13T13:03:38Z")

</div>

Thanks for your reply!  
I've looked up the required configuration. And I changed the transport.host to 0.0.0.0. And I found no more required configurations.  
but this doesn't work for me.  
I also tried to give a URL to the enrollment command:

```auto
/usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s node --url "https://FQDN:9200"

```

when I run this I get the flooring Error:

```auto
Unable to create enrollment token for scope [node]

ERROR: Unable to create an enrollment token. Elasticsearch node HTTP layer SSL configuration is not configured with a Keystore

```

It seems I need a Keystore but I thought the Keystore is autogenerated.

But when I try to run the command without a URL he's trying to use an SLL connection with the node IP. but obviously, that doesn't work because the certificate is issued to the domain.

---

<div class="post-metadata">

**Author:** ![Ayush\_Mathur](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ayush_mathur/32/77134_2.png) [@Ayush\_Mathur](https://discuss.elastic.co/u/Ayush_Mathur)\
**Post date:** [January 13, 2023, 1:18pm UTC](https://discuss.elastic.co/t/how-to-add-new-node-to-elasticsearch-cluster-with-https/322942/4 "2023-01-13T13:18:26Z")

</div>

You don't have to provide the URL when generating the enrollment token and must be generated from the first/old node. But if you are providing, it should be the URL of old node.  
Also, according to [elasticsearch-create-enrollment-token | Elasticsearch Guide [8.6] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/create-enrollment-token.html), you need to ensure `file realm` is not disabled in ES and ES\_PATH\_CONF variable is defined if you are not using default configuration file.

---

<div class="post-metadata">

**Author:** ![makkaroni8](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/makkaroni8/32/108854_2.png) [@makkaroni8](https://discuss.elastic.co/u/makkaroni8)\
**Post date:** [January 13, 2023, 2:56pm UTC](https://discuss.elastic.co/t/how-to-add-new-node-to-elasticsearch-cluster-with-https/322942/5 "2023-01-13T14:56:58Z")

</div>

I've not moved the default(config in /etc/elasticsearch).

> `elasticsearch-create-enrollment-token` can only be used with Elasticsearch clusters that have been [auto-configured for security](https://www.elastic.co/guide/en/elasticsearch/reference/current/configuring-stack-security.html).

I have found this comment ^ at elasticsearch-create-enrollment-token.

I'm not sure but this means the `elasticsearch-create-enrollment-token` work only with the default Certs, right?

The problem is I can't use the default Certs due to Security issues.

---

<div class="post-metadata">

**Author:** ![Ayush\_Mathur](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ayush_mathur/32/77134_2.png) [@Ayush\_Mathur](https://discuss.elastic.co/u/Ayush_Mathur)\
**Post date:** [January 13, 2023, 3:03pm UTC](https://discuss.elastic.co/t/how-to-add-new-node-to-elasticsearch-cluster-with-https/322942/6 "2023-01-13T15:03:11Z")

</div>

OK, in that case you need to configure your ES (elasticsearch.yml) with SSL properties as described here: [Set up basic security for the Elastic Stack plus secured HTTPS traffic | Elasticsearch Guide [8.6] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-basic-setup-https.html)  
Since you already have the certs available, just follow the steps for new node and update the config yml for both nodes. Also, please make sure you are setting `discovery` and `initial_master_nodes` property in new node. Please refer to : [Add and remove nodes in your cluster | Elasticsearch Guide [8.6] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/add-elasticsearch-nodes.html)

---

<div class="post-metadata">

**Author:** ![makkaroni8](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/makkaroni8/32/108854_2.png) [@makkaroni8](https://discuss.elastic.co/u/makkaroni8)\
**Post date:** [January 16, 2023, 11:09am UTC](https://discuss.elastic.co/t/how-to-add-new-node-to-elasticsearch-cluster-with-https/322942/7 "2023-01-16T11:09:59Z")

</div>

Thanks,  
this works sort of.  
now I'm getting on the new node a discovery warning and he can't join

```auto
[2023-01-16T11:48:49,791][WARN][o.e.c.c.ClusterFormationFailureHelper] [node-2(new node) HOSTNAME] master not discovered yet, this node has not previously joined a bootstrapped cluster,
and this node must discover master-eligible nodes [node-1(old Note) HOSTNAME] to bootstrap a cluster: have discovered [{node-2(new node) HOSTNAME}{XXXXXXX}{XXXXXX}
{node-2(new node) HOSTNAME}{node-2(new node) IP}{node-2(new node) IP AND PORT}{XXXXX}, {node-1(old Note) HOSTNAME}{XXXXXXX}{XXXXXXX}{node-1(old Note) HOSTNAME}{node-1(old Note) IP}{node-1(old Note) IP AND PORT}
{XXXXXXX}]; discovery will continue using [node-1(old Note) IP AND PORT, node-2(new node) IP AND PORT] from hosts providers and [{node-2(new node) HOSTNAME}{XXXXXX}{XXXXXX}
{node-2(new node) HOSTNAME}{node-2(new node) IP}{node-2(new node) IP AND PORT}{XXXXX}] from last-known cluster state; node term 29, last-accepted version 0 in term 0; joining 
[{node-1(old Note) HOSTNAME}{XXXXXX}{XXXXXX}{node-1(old Note) HOSTNAME}{node-1(old Note) IP}{node-1(old Note) IP AND PORT}{XXXXXXX}]
in term [29] has status [waiting for response] after [9.8s/9806ms]

```

I found in [Bootstrapping a cluster | Elasticsearch Guide [7.17] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/7.17/modules-discovery-bootstrap-cluster.html#modules-discovery-bootstrap-cluster)

> `[master-a.example.com] master not discovered yet, this node has not previously joined a bootstrapped (v7+) cluster, and this node must discover master-eligible nodes [master-a, master-b] to bootstrap a cluster: have discovered [{master-b.example.com}{...`  
> This message shows the node names `master-a.example.com` and `master-b.example.com` as well as the `cluster.initial_master_nodes` entries `master-a` and `master-b` , and it is clear from this message that they do not match exactly.

I've changed my config to (I have to do some things in the `xpack.security.transport.ssl` to make it work to this point, otherwise I got a certificate Error. not optimal but I have found no solution):  
Old Note/new note:

```auto
discovery.seed_hosts: ["Old note", "new Note"]
cluster.initial_master_nodes: ["Old Note"]
xpack.security.transport.ssl:
  verification_mode: none
  client_authentication: none

```

And I used the same names in discovery.seed\_hosts and cluster.initial\_master\_nodes on both sides

---

<div class="post-metadata">

**Author:** ![Ayush\_Mathur](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ayush_mathur/32/77134_2.png) [@Ayush\_Mathur](https://discuss.elastic.co/u/Ayush_Mathur)\
**Post date:** [January 16, 2023, 2:00pm UTC](https://discuss.elastic.co/t/how-to-add-new-node-to-elasticsearch-cluster-with-https/322942/8 "2023-01-16T14:00:19Z")

</div>

Right, I guess somewhere in 7x versions, Transport SSL became a mandate for n-node clusters, so you need to configure Transport SSL so your nodes can talk to each other.

Also to highlight, `ssl.transport` must be enabled else your nodes won't be able to join the cluster.

You can use `elasticsearch-certutil` which is bundled along with elasticsearch and is available in /bin folder. You can either generate P12 certificates and use them or use SAN based ca/instance/key certificates. Documentation is available here: [elasticsearch-certutil | Elasticsearch Guide [8.6] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/certutil.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 13, 2023, 2:00pm UTC](https://discuss.elastic.co/t/how-to-add-new-node-to-elasticsearch-cluster-with-https/322942/9 "2023-02-13T14:00:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.