# Import CA Cert as PrivateKeyEntry to HTTP Keystore - Solve Unable to create enrollment token Error **URL:** https://discuss.elastic.co/t/import-ca-cert-as-privatekeyentry-to-http-keystore-solve-unable-to-create-enrollment-token-error/313780 **Category:** Elasticsearch **Tags:** elastic-stack-security **Created:** [September 6, 2022, 10:25am UTC](https://discuss.elastic.co/t/import-ca-cert-as-privatekeyentry-to-http-keystore-solve-unable-to-create-enrollment-token-error/313780 "2022-09-06T10:25:31Z") **Posts on this page:** 1 **Showing post:** 2
### Author: ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang) #### Post date: [September 7, 2022, 12:38am UTC](https://discuss.elastic.co/t/import-ca-cert-as-privatekeyentry-to-http-keystore-solve-unable-to-create-enrollment-token-error/313780/2 "2022-09-07T00:38:02Z")
@aold619 Did you test whether the generated enrollment-token is usable by Kibana? I suspect it won't be usable because you added another (different) CA key/cert into the HTTP truststore. This makes the token generation process work. But the token will be generated with the CA that is **not** the one that signs your HTTP cert. Hence Kibana will fail to validate the HTTPS connection to Elasticsearch. What you want is to add original CA's key to the truststore. The original CA is the one that you used to generate the http certs with the command `./bin/elasticsearch-certutil http`. Maybe this is what you actually did? If so, could you please clarify this in _Step 1_? Btw, we have a public issue to track this problem [Generating enrolment token for Kibana should not require the CA key · Issue #89017 · elastic/elasticsearch · GitHub](https://github.com/elastic/elasticsearch/issues/89017) --- _[View the full topic](https://discuss.elastic.co/t/import-ca-cert-as-privatekeyentry-to-http-keystore-solve-unable-to-create-enrollment-token-error/313780)._