# Unable to create an enrollment token
**URL:** https://discuss.elastic.co/t/unable-to-create-an-enrollment-token/327917
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [March 17, 2023, 9:56am UTC](https://discuss.elastic.co/t/unable-to-create-an-enrollment-token/327917 "2023-03-17T09:56:26Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@geb](https://discuss.elastic.co/u/geb)
#### Post date: [March 17, 2023, 9:56am UTC](https://discuss.elastic.co/t/unable-to-create-an-enrollment-token/327917/1 "2023-03-17T09:56:26Z")
Hi,
i try to add a node at at new formed 8.6 cluster. As the first step i configured the ca, certificates and modified the elasticsearch.yml Cluster started -\> fine
The error is also described in:
> [@ERROR: Failed to determine the health of the cluster with elasticsearch-create-enrollment-token](https://discuss.elastic.co/t/error-failed-to-determine-the-health-of-the-cluster-with-elasticsearch-create-enrollment-token/297041/1):
>
> I have Elasticsearch cluster on my local machine with enabled HTTPs (2 nodes), all is working fine, I am trying to use the new tool Elasticsearch-create-enrollment-token to enroll the third node, but I got the following error ERROR: Failed to determine the health of the cluster when I execute the following command Elasticsearch-create-enrollment-token -s node -v How can I determine the root cause of this issue BTW, I have the following settings for SSL # This turns on SSL for the HTTP …
This statement doesnt help:
[ikakavas](https://discuss.elastic.co/u/ikakavas)[Ioannis Kakavas](https://discuss.elastic.co/u/ikakavas)[Elastic Team Member](https://discuss.elastic.co/g/elastic_team)
[Feb 2022](https://discuss.elastic.co/t/error-failed-to-determine-the-health-of-the-cluster-with-elasticsearch-create-enrollment-token/297041/2)
Hi there,
The enrolment process is designed to work only with the auto-configured TLS setup that one gets with Elasticsearch 8.0.
...
My Config:
```auto
#----------------------- BEGIN SECURITY AUTO CONFIGURATION -----------------------
#
# The following settings, TLS certificates, and keys have been automatically
# generated to configure Elasticsearch security features on 02-03-2023 12:17:50
#
# --------------------------------------------------------------------------------
discovery.seed_hosts: [slvtmgrels99, slvtmgrels98, slvtmgrels97]
#xpack.security.enrollment.enabled: true
# Enable security features
xpack.security.enabled: true
xpack.security.enrollment.enabled: true
# Enable encryption for HTTP API client connections, such as Kibana, Logstash, and Agents
xpack.security.http.ssl:
enabled: true
verification_mode: certificate
keystore.path: /etc/elasticsearch/certificate/slvtmgrels99.p12
## keystore or key/certificate
#key: /etc/elasticsearch/certificate/slvtmgrels99.key
#certificate: /etc/elasticsearch/certificate/slvtmgrels99.crt
certificate_authorities: /etc/elasticsearch/certificate/elk_t99-ca.crt
# Enable encryption and mutual authentication between cluster nodes
xpack.security.transport.ssl:
enabled: true
verification_mode: certificate
keystore.path: /etc/elasticsearch/certificate/slvtmgrels99.p12
# truststore or cert_auth ... not both
# truststore.path: /etc/elasticsearch/certificate/slvtmgrels99.p12
certificate_authorities: /etc/elasticsearch/certificate/elk_t99-ca.crt
# Create a new cluster with the current node only
# Additional nodes can still join the cluster later
cluster.initial_master_nodes: ["slvtmgrels99"]
# Allow HTTP API connections from anywhere
# Connections are encrypted and require user authentication
http.host: 0.0.0.0
# Allow other nodes to join the cluster from anywhere
# Connections are encrypted and mutually authenticated
transport.host: 0.0.0.0
#----------------------- END SECURITY AUTO CONFIGURATION -------------------------
```
My Error message:
```auto
slvtmgrels99:/etc/elasticsearch/certificate # /usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s node
Unable to create enrollment token for scope [node]
ERROR: Unable to create an enrollment token. Elasticsearch node HTTP layer SSL configuration Keystore doesn't contain any PrivateKey entries where the associated certificate is a CA certificate
```
Any suggestions?
Sry for my bad layout!
regards
harry
---
### Author:  [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)
#### Post date: [March 17, 2023, 7:38pm UTC](https://discuss.elastic.co/t/unable-to-create-an-enrollment-token/327917/2 "2023-03-17T19:38:16Z")
This is a known issue. Please see [Import CA Cert as PrivateKeyEntry to HTTP Keystore - Solve Unable to create enrollment token Error - #2 by Yang\_Wang](https://discuss.elastic.co/t/import-ca-cert-as-privatekeyentry-to-http-keystore-solve-unable-to-create-enrollment-token-error/313780/2)
---
### Author:  [@geb](https://discuss.elastic.co/u/geb)
#### Post date: [March 20, 2023, 8:47am UTC](https://discuss.elastic.co/t/unable-to-create-an-enrollment-token/327917/3 "2023-03-20T08:47:36Z")
Works, thx a lot.
regards
harry
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 17, 2023, 8:48am UTC](https://discuss.elastic.co/t/unable-to-create-an-enrollment-token/327917/4 "2023-04-17T08:48:04Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.