# How to generate es ssl cert for Azure application gateway? **URL:** \ **Category:** Elasticsearch\ **Created:** [September 4, 2024, 11:22am UTC](https://discuss.elastic.co/t/how-to-generate-es-ssl-cert-for-azure-application-gateway/366029 "2024-09-04T11:22:58Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![hoover\_he](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hoover_he/32/137301_2.png) [@hoover\_he](https://discuss.elastic.co/u/hoover_he)\ **Post date:** [September 4, 2024, 11:22am UTC](https://discuss.elastic.co/t/how-to-generate-es-ssl-cert-for-azure-application-gateway/366029/1 "2024-09-04T11:22:58Z")
Recently we installed 5 nodes as an Elasticsearch 8.14 cluster in Azure virtual machine. Then initiated one Azure application gateway as load balancer for the Elasticsearch cluster. Need to upload es cluster ssl certificate in Azure application gateway. I uploaded http\_ca.crt, converted it as http\_ca.cer, uploaded it into Azure application gateway. As the below screenshot from Azure application gateway, it failed to connect to es cluster. How to generate es ssl cert for Azure application gateway? Who can give me more detailed guide? ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/e/7e957164ed0fea0a5c4a59a75c89f431dd3e2529.png) ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [September 4, 2024, 1:39pm UTC](https://discuss.elastic.co/t/how-to-generate-es-ssl-cert-for-azure-application-gateway/366029/2 "2024-09-04T13:39:02Z")
The error seems to be indicating that certificate is not providing a matched common name which you're using to access elasticsearch. That's pretty common problem. You need to create the HTTPS certificate That contains the common name, DNS name, and or IP addresses that you're going to use to access the elasticsearch services.from the load balancer Take a look here.... [elasticsearch-certutil | Elasticsearch Guide [8.15] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/certutil.html#certutil-silent). You can check what is in the search by using `curl -v -k -u elastic https://:9200` ---
**Author:** ![hoover\_he](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hoover_he/32/137301_2.png) [@hoover\_he](https://discuss.elastic.co/u/hoover_he)\ **Post date:** [September 4, 2024, 4:24pm UTC](https://discuss.elastic.co/t/how-to-generate-es-ssl-cert-for-azure-application-gateway/366029/3 "2024-09-04T16:24:42Z")
Many thanks for your quick reply. Then I need to substitute the http.p12 with the newly-generated p12 file in each node, extract the CA file from elastic-stack-ca.p12, upload the CA file to Azure application gateway. Right? Finally, I got this error. ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/c/3cdbfb265ee223b74c6d95491ef7567021bc4d28.png) ---
**Author:** ![hoover\_he](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hoover_he/32/137301_2.png) [@hoover\_he](https://discuss.elastic.co/u/hoover_he)\ **Post date:** [September 4, 2024, 4:28pm UTC](https://discuss.elastic.co/t/how-to-generate-es-ssl-cert-for-azure-application-gateway/366029/4 "2024-09-04T16:28:36Z")
If I match 401 as success, that's ok. Do we have other solution for this error? ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/d/fd0755832fd4401868fdc9f5aca1775ce15c4675.png) ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [September 4, 2024, 4:50pm UTC](https://discuss.elastic.co/t/how-to-generate-es-ssl-cert-for-azure-application-gateway/366029/5 "2024-09-04T16:50:37Z")
@hoover_he Good Progress.... > [@hoover\_he](#): > > If I match 401 as success, that's ok. Do we have other solution for this error? Well, only if you want to send an authenticated request.... you can use an API key... in the Header and hit health endpoint. Once locked down everything is authenticated... `https://host:9200_cat/health?format=json` ---
**Author:** ![hoover\_he](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hoover_he/32/137301_2.png) [@hoover\_he](https://discuss.elastic.co/u/hoover_he)\ **Post date:** [September 4, 2024, 4:58pm UTC](https://discuss.elastic.co/t/how-to-generate-es-ssl-cert-for-azure-application-gateway/366029/6 "2024-09-04T16:58:32Z")
Thanks for your kind guide. I did what you suggested in master node. But while I executed "/usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s node", I faced another issue. What should I do? Unable to create enrollment token for scope [node] ERROR: Unable to create an enrollment token. Elasticsearch node HTTP layer SSL configuration Keystore doesn't contain any PrivateKey entries where the associated certificate is a CA certificate, with exit code 73 ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [September 4, 2024, 5:03pm UTC](https://discuss.elastic.co/t/how-to-generate-es-ssl-cert-for-azure-application-gateway/366029/7 "2024-09-04T17:03:26Z")
@hoover_he I think you already have a topic open on that lets not mix / duplicate... Please put those updated details in the other topic... and what you did to get to that steps...