# Unable to create an enrollment token for Kibana. "Elasticsearch node HTTP layer SSL configuration Keystore doesn't contain any PrivateKey entries where the associated certificate is a CA certificate" **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [February 12, 2022, 12:46am UTC](https://discuss.elastic.co/t/unable-to-create-an-enrollment-token-for-kibana-elasticsearch-node-http-layer-ssl-configuration-keystore-doesnt-contain-any-privatekey-entries-where-the-associated-certificate-is-a-ca-certificate/297032 "2022-02-12T00:46:48Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![maof97](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maof97/32/101433_2.png) [@maof97](https://discuss.elastic.co/u/maof97)\ **Post date:** [February 12, 2022, 12:46am UTC](https://discuss.elastic.co/t/unable-to-create-an-enrollment-token-for-kibana-elasticsearch-node-http-layer-ssl-configuration-keystore-doesnt-contain-any-privatekey-entries-where-the-associated-certificate-is-a-ca-certificate/297032/1 "2022-02-12T00:46:48Z")
Hello, I tried today to setup my ELK stack securely so I followed the documentation and created all certs that I need using the certutil and encrypted the CA and the node cert with passwords. I placed the http.p12 file to /etc/Elasticsearch/certs/ Elasticsearch. Then I updated the keystone as told in the README: ```auto elasticsearch-keystore add "xpack.security.http.ssl.keystore.secure_password" ``` and typed my node's p12 password here. Now I wanted to add Kibana from another server so I tried to create the enrollment token but it failed: ```auto elasticsearch-create-enrollment-token -s kibana ERROR: Unable to create an enrollment token for Kibana. Elasticsearch node HTTP layer SSL configuration Keystore doesn't contain any PrivateKey entries where the associated certificate is a CA certificate ``` I am a bit confused. Why isn't the PrivateKey there? And what exactly does it mean that there is no associated CA certificate? Do I need to place the ca.p12 somewhere too? If yes then where? And with which command do I type the PrivateKey for that? Or did I make another mistake somewhere else? I would really appreciate any help. Edit: I am on Elasticsearch 8.0 on a newly installed Ubuntu VM ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [February 12, 2022, 2:21am UTC](https://discuss.elastic.co/t/unable-to-create-an-enrollment-token-for-kibana-elasticsearch-node-http-layer-ssl-configuration-keystore-doesnt-contain-any-privatekey-entries-where-the-associated-certificate-is-a-ca-certificate/297032/2 "2022-02-12T02:21:14Z")
The Kibana enrollment process relies on the configuration that is produced by the auto-generated security (TLS) setup that is included in Elasticsearch 8.0 It is possible to manually configure TLS in a way that meets the requirements for Kibana enrollment, but I don't think we have explicit documentation on how to do that - the design and intent is that it all flows through the automated setup process. > [@maof97](#): > > ```auto > elasticsearch-create-enrollment-token -s kibana > ERROR: Unable to create an enrollment token for Kibana. Elasticsearch node HTTP layer SSL configuration Keystore doesn't contain any PrivateKey entries where the associated certificate is a CA certificate > > ``` I think this can probably be classed as a bug (or at least a rough edge on the feature). Kibana enrollment shouldn't require the CA private key. Node enrollment does, and I suspect we're applying the same validation regardless of the type on token being generated. ---
**Author:** ![maof97](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maof97/32/101433_2.png) [@maof97](https://discuss.elastic.co/u/maof97)\ **Post date:** [February 12, 2022, 12:58pm UTC](https://discuss.elastic.co/t/unable-to-create-an-enrollment-token-for-kibana-elasticsearch-node-http-layer-ssl-configuration-keystore-doesnt-contain-any-privatekey-entries-where-the-associated-certificate-is-a-ca-certificate/297032/3 "2022-02-12T12:58:05Z")
Hey thanks for the fast response. The actual reason why I made all this certificates on my own is because I got the following response trying to access the API via https: ```auto curl --cacert /Users/martin/Downloads/http_ca.crt -u elastic https://10.24.1.5:9200 Enter host password for user 'elastic': curl: (60) SSL: no alternative certificate subject name matches target host name '10.24.1.5' More details here: https://curl.se/docs/sslcerts.html curl failed to verify the legitimacy of the server and therefore could not establish a secure connection to it. To learn more about this situation and how to fix it, please visit the web page mentioned above. ``` It seems like the default cert generated does not add the IP/Domain to the Subject-Name field. It only worked if I tried via [https://localhost:9200](https://localhost:9200) What are the steps for me to use TLS now? Can I re-do the auto generated security setup with the right Subject-Names? Or am I forced to just access the API vial localhost? ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [February 14, 2022, 5:13am UTC](https://discuss.elastic.co/t/unable-to-create-an-enrollment-token-for-kibana-elasticsearch-node-http-layer-ssl-configuration-keystore-doesnt-contain-any-privatekey-entries-where-the-associated-certificate-is-a-ca-certificate/297032/4 "2022-02-14T05:13:36Z")
> [@maof97](#): > > It seems like the default cert generated does not add the IP/Domain to the Subject-Name field. It only worked if I tried via [https://localhost:9200](https://localhost:9200) We do our best to detect all IP addresses of the interfaces that are up when elasticsearch is installed and then use them as IP Subject Alternative Names in the HTTP TLS certificate. How is the networking configured for your VM ? Is `10.24.1.5` an IP address that the VM itself is aware of or are you using NAT ? If you still have these around, you can take a look at what IP addresses we found out by inspecting the certificate. (I'm assuming you have installed this with the DEB package, so the following commands apply to that ) ```auto # /usr/share/elasticsearch/bin/elasticsearch-keystore show xpack.security.http.ssl.keystore.secure_password ``` will show you the password for the http.p12 keystore. Then you can run ```auto keytool -keystore /etc/elasticsearch/config/certs/http.p12 -storepass -list -v ``` and look at the section that starts with `Alias name: http`. As to what you can do now, you can either: - Reinstall elasticsearch and use an IP address/hostname to access it that exists in the SANs of the certificate. Use the enrollment process as described in to configure Kibana or - Manually configure TLS following the instructions we have in [Set up basic security for the Elastic Stack plus secured HTTPS traffic | Elasticsearch Guide [8.11] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-basic-setup-https.html) > [@TimV](#): > > > [@maof97](#): > > > > ````auto > > > elasticsearch-create-enrollment-token -s kibana > > ERROR: Unable to create an enrollment token for Kibana. Elasticsearch node HTTP layer SSL configuration Keystore doesn't contain any PrivateKey entries where the associated certificate is a CA certificate > > > ``` > > > > ```` > > I think this can probably be classed as a bug (or at least a rough edge on the feature). > Kibana enrollment shouldn't require the CA private key. Node enrollment does, and I suspect we're applying the same validation regardless of the type on token being generated. We will track this and see if it makes sense to allow creating kibana enrollment tokens with manual/custom TLS setups and/or enhance the error message to make it clearer why it fails. Thanks for reporting this @maof97 ! ---
**Author:** ![maof97](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maof97/32/101433_2.png) [@maof97](https://discuss.elastic.co/u/maof97)\ **Post date:** [February 14, 2022, 8:32pm UTC](https://discuss.elastic.co/t/unable-to-create-an-enrollment-token-for-kibana-elasticsearch-node-http-layer-ssl-configuration-keystore-doesnt-contain-any-privatekey-entries-where-the-associated-certificate-is-a-ca-certificate/297032/5 "2022-02-14T20:32:33Z")
Yeah because of restrictions I have to install ES using a different interface than the one used in production. Maybe add a feature to specify the production IP address on installation for cases like mine. ---
**Author:** ![cyberzlo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cyberzlo/32/65490_2.png) [@cyberzlo](https://discuss.elastic.co/u/cyberzlo)\ **Post date:** [March 8, 2022, 1:54am UTC](https://discuss.elastic.co/t/unable-to-create-an-enrollment-token-for-kibana-elasticsearch-node-http-layer-ssl-configuration-keystore-doesnt-contain-any-privatekey-entries-where-the-associated-certificate-is-a-ca-certificate/297032/6 "2022-03-08T01:54:44Z")
Creating this due `apt-get install` is bad idea. I need do build on dev enviroment, I can't install ELK on prod... after moving I just edit network stuff and should work, but it don't as ELK hardcode IPs etc ☹ ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [March 11, 2022, 1:09pm UTC](https://discuss.elastic.co/t/unable-to-create-an-enrollment-token-for-kibana-elasticsearch-node-http-layer-ssl-configuration-keystore-doesnt-contain-any-privatekey-entries-where-the-associated-certificate-is-a-ca-certificate/297032/7 "2022-03-11T13:09:32Z")
Apologies but it’s not clear from you comment what your problem is. Please don’t hijack other topics, open a new one and explain in detail what your issue is. We will do our best to help you out ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 8, 2022, 1:10pm UTC](https://discuss.elastic.co/t/unable-to-create-an-enrollment-token-for-kibana-elasticsearch-node-http-layer-ssl-configuration-keystore-doesnt-contain-any-privatekey-entries-where-the-associated-certificate-is-a-ca-certificate/297032/8 "2022-04-08T13:10:20Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.