How to generate the enrollment-token for another node with ssl?

[merson]

Unable to create enrollment token for scope[node]

ERROR: Unable to create an enrollment token. Elasticsearch node HTTP layer ssl configuration Keystore doesn't contain any private entries where the associated certificate is a CA certificate

[Yang_Wang]

This is a known issue see Generating enrolment token for Kibana should not require the CA key · Issue #89017 · elastic/elasticsearch · GitHub

[merson]

Thank you.

Let me check.

[merson]

but am facing this issue while generate a new node for elasticsearch-clustering

[stephenb (Stephen Brown)]

Hi @merson Welcome to the community.

Perhaps take a look at this.

Elasticsearch-create-enrollment-token is not possible without a keystore ( aka with PEM certificates)

Hi @DavidDPD Welcome to the community, and apologies for the frustrating experience. Yes a bit frustrating and probably could be documented better. I think perhaps there is a fundamental "disconnect" At least this is how I understand it.... When you want to use your own certs etc, you are no longer using security auto configuration and thus when you use your own certs you should no longer be trying to "enroll" another node in the cluster using an enrollment token... the elasticsearch-create-…

In short if you set up your own certs (i.e. did not use security auto-configuration) you just need to manually setup your other nodes to join the clusters

[Yang_Wang]

@merson

but am facing this issue while generate a new node for elasticsearch-clustering

The underlying cause is the same for node or kibana enrollment.

[merson]

Thank you .
@stephenb