# Import CA Cert as PrivateKeyEntry to HTTP Keystore - Solve Unable to create enrollment token Error **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [September 6, 2022, 10:25am UTC](https://discuss.elastic.co/t/import-ca-cert-as-privatekeyentry-to-http-keystore-solve-unable-to-create-enrollment-token-error/313780 "2022-09-06T10:25:31Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![aold619](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aold619/32/110521_2.png) [@aold619](https://discuss.elastic.co/u/aold619)\ **Post date:** [September 6, 2022, 10:25am UTC](https://discuss.elastic.co/t/import-ca-cert-as-privatekeyentry-to-http-keystore-solve-unable-to-create-enrollment-token-error/313780/1 "2022-09-06T10:25:31Z")
## Problem Yesterday I installed Elasticsearch for the first time, and after I configured the security manully according to the docs: [Basic Security](https://www.elastic.co/guide/en/elasticsearch/reference/master/security-basic-setup.html) / [Basic Security plus HTTPS](https://www.elastic.co/guide/en/elasticsearch/reference/master/security-basic-setup-https.html), I try to generate token for Kibana, and I met the error: > ERROR: Unable to create an enrollment token. Elasticsearch node HTTP layer SSL configuration Keystore doesn't contain any PrivateKey entries where the associated certificate is a CA certificate I searched some pages and didn't get the answer, then I found a [discussion](https://stackoverflow.com/questions/24974324/import-certificate-as-privatekeyentry) on StackOverflow, and it solved my problem. I think maybe I should share my experience with those newbies like me. * * * ## Solution ### Step 1. Generate Keystore contains CA Cert and HTTP Keystore [optional] _ **Note:** _ _Usually we have done this step, so if you didn't do anything else to change these Keystores, skip this step._ Following [Basic Security](https://www.elastic.co/guide/en/elasticsearch/reference/master/security-basic-setup.html) we will get a PKCS12 Keystore containing CA Cert, default filename is **elastic-stack-ca.p12**. Following [Basic Security plus HTTPS](https://www.elastic.co/guide/en/elasticsearch/reference/master/security-basic-setup-https.html), we will get a PKCS12 Keystore contains a _TrustedCertEntry_ that import from **elastic-stack-ca.p12** , the default filename of HTTP Keystore is **http.p12**. ### Step 2. Import CA Cert Keystore to HTTP Keystore as PrivateKey type ```shell keytool -importkeystore -destkeystore -srckeystore -srcstoretype PKCS12 ``` This step changes the CA Cert that was automatically imported into the original HTTP Keystore as TrustCertEntry to PrivateKeyEntry, and this is exactly what that ERROR tells us to do. > Importing keystore config/certs/es-ca.p12 to config/certs/http.p12... > Enter destination keystore password: > Enter source keystore password: > Existing entry alias ca exists, overwrite? [no]: yes > Entry for alias ca successfully imported. > Import command completed: 1 entries successfully imported, 0 entries failed or cancelled ## Check the result And you can use following command to check: ```shell keytool -keystore -list ``` The result should contains two PrivateKey entries like: > Keystore type: PKCS12 > Keystore provider: SUN > > Your keystore contains 2 entries > > ca, Sep 5, 2022, PrivateKeyEntry, > Certificate fingerprint (SHA-256): 53:F4:9A:9D:56:A9:3A:AF:90:94:41:FA:D7:15:3F:DF:C1:39:AC:BA:FF:12:44:C0:36:4D:15:4C:20:14:1E:3D > http, Sep 5, 2022, PrivateKeyEntry, > Certificate fingerprint (SHA-256): EF:8D:78:EC:F0:C5:97:1B:7B:58:EF:5F:E3:73:A5:D0:7E:1B:FE:B3:75:B0:B4:D9:CB:80:FC:B3:8E:5D:A5:74 Before generating a new token, make sure you added the password for your private key to the security settings in Elasticsearch. ```shell ./bin/elasticsearch-keystore [show|add] xpack.security.http.ssl.keystore.secure_password ``` ## Re-Generate token Now start the node, and re-generate your token: ```shell ./bin/elasticsearch-create-enrollment-token -s [kibana|node] ``` ---
**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\ **Post date:** [September 7, 2022, 12:38am UTC](https://discuss.elastic.co/t/import-ca-cert-as-privatekeyentry-to-http-keystore-solve-unable-to-create-enrollment-token-error/313780/2 "2022-09-07T00:38:02Z")
@aold619 Did you test whether the generated enrollment-token is usable by Kibana? I suspect it won't be usable because you added another (different) CA key/cert into the HTTP truststore. This makes the token generation process work. But the token will be generated with the CA that is **not** the one that signs your HTTP cert. Hence Kibana will fail to validate the HTTPS connection to Elasticsearch. What you want is to add original CA's key to the truststore. The original CA is the one that you used to generate the http certs with the command `./bin/elasticsearch-certutil http`. Maybe this is what you actually did? If so, could you please clarify this in _Step 1_? Btw, we have a public issue to track this problem [Generating enrolment token for Kibana should not require the CA key · Issue #89017 · elastic/elasticsearch · GitHub](https://github.com/elastic/elasticsearch/issues/89017) ---
**Author:** ![aold619](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aold619/32/110521_2.png) [@aold619](https://discuss.elastic.co/u/aold619)\ **Post date:** [September 7, 2022, 2:30am UTC](https://discuss.elastic.co/t/import-ca-cert-as-privatekeyentry-to-http-keystore-solve-unable-to-create-enrollment-token-error/313780/3 "2022-09-07T02:30:16Z")
@Yang_Wang Thank you for correcting me! And sorry I posted this directly without further verification. I can't connect Kibana, you're right. The following content is my fix. For _Step 1_, I should generate HTTP PKCS follow [Basic Security plus HTTPS](https://www.elastic.co/guide/en/elasticsearch/reference/master/security-basic-setup-https.html), then use cmd in _Step 2_ to import previous PKCS generated by [Basic Security](https://www.elastic.co/guide/en/elasticsearch/reference/master/security-basic-setup.html) to the HTTP PKCS ```shell keytool -importkeystore -destkeystore -srckeystore -srcstoretype PKCS12 ``` Overwrite the existing entry: > Importing keystore config/certs/es-ca.p12 to config/certs/http.p12... > Enter destination keystore password: > Enter source keystore password: > Existing entry alias ca exists, overwrite? [no]: yes > Entry for alias ca successfully imported. > Import command completed: 1 entries successfully imported, 0 entries failed or cancelled Now if we check the _http.p12_, the default **ca, TrustedCert Entry** will become **ca, PrivateKey Entry**. > Enter keystore password: > Keystore type: PKCS12 > Keystore provider: SUN > > Your keystore contains 2 entries > > ca, Sep 7, 2022, PrivateKeyEntry, > Certificate fingerprint (SHA-256): 6D:19:EA:C5:37:FC:4B:4B:3C:34:43:E8:71:5C:2B:22:F3:E5:A0:23:B2:F8:91:51:D4:6E:C1:34:66:6E:49:42 > http, Sep 7, 2022, PrivateKeyEntry, > Certificate fingerprint (SHA-256): 0D:F9:57:C6:DB:E6:93:31:3D:12:46:82:FE:EA:7F:AE:23:05:C2:49:A3:5A:7B:77:61:1A:2F:F2:E7:B3:DF:6D I verified that `bin/elasticsearch-create-enrollment-token` is working, and I can also use this generated token to connect to Kibana. * * * Please review my fix step, and if it is correct, should I edit my main post to fix the error? ---
**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\ **Post date:** [September 7, 2022, 2:48am UTC](https://discuss.elastic.co/t/import-ca-cert-as-privatekeyentry-to-http-keystore-solve-unable-to-create-enrollment-token-error/313780/4 "2022-09-07T02:48:40Z")
Your fix looks correct to me. > [@aold619](#): > > should I edit my main post to fix the error? That would be great. Thanks! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 5, 2022, 2:49am UTC](https://discuss.elastic.co/t/import-ca-cert-as-privatekeyentry-to-http-keystore-solve-unable-to-create-enrollment-token-error/313780/5 "2022-10-05T02:49:34Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.