# Unable to Create Enrollment Token After http.p12 Certificate Renewal

**URL:** <https://discuss.elastic.co/t/unable-to-create-enrollment-token-after-http-p12-certificate-renewal/374842>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-monitoring, elastic-stack-security\
**Created:** [February 21, 2025, 7:35am UTC](https://discuss.elastic.co/t/unable-to-create-enrollment-token-after-http-p12-certificate-renewal/374842 "2025-02-21T07:35:14Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rushali](https://avatars.discourse-cdn.com/v4/letter/r/59ef9b/32.png) [@Rushali](https://discuss.elastic.co/u/Rushali)\
**Post date:** [February 21, 2025, 7:35am UTC](https://discuss.elastic.co/t/unable-to-create-enrollment-token-after-http-p12-certificate-renewal/374842/1 "2025-02-21T07:35:14Z")

</div>

I followed the official guide for the renewal of http.p12 cert for Elasticsearch:  
[Basic Security Setup with HTTPS](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-basic-setup-https.html)

After renewing the `http.p12` certificate, we are facing an issue where we cannot generate an enrollment token for both nodes and Kibana.

```auto
Unable to create enrollment token for scope [node]

ERROR: Unable to create an enrollment token. Elasticsearch node HTTP layer SSL configuration Keystore doesn't contain any PrivateKey entries where the associated certificate is a CA certificate

```

Steps followed-

1. Encountered an issue during certificate renewal:

- The guide mentions using `elastic-stack-ca.p12`, but we couldn't find this file.
- Instead, we passed `http_ca.crt` as the CA certificate.
- However, it then asked for the private CA key, which we didn’t have separately.
- To work around this, we exported the private key from the old `http.p12` certificate and used it to generate the new `http.p12` cert.

1. Updated the Elasticsearch configuration (`elasticsearch.yml`) with the new certificate.
2. Restarted Elasticsearch nodes to apply the changes.

**Observations (Comparing Old vs. New http.p12 Certificates):**

1. Old `http.p12` contained:

- Certificates (3): `http_ca`, `http`, `CN=Elasticsearch security auto-configuration HTTP CA`
- Private Keys (2): `http_ca`, `http`

1. New `http.p12` contains:

- Certificates (2): `CN=Elasticsearch security auto-configuration HTTP CA`, `http_ca`
- Private Key (1): `http`  
**Key Difference:**
- In the old `http.p12`, `CN=Elasticsearch security auto-configuration HTTP CA` and `http_ca` were the same.
- The new `http.p12` no longer has `http_ca` as a private key.

Questions-  
Since we didn't have `elastic-stack-ca.p12`, was it correct to use `http_ca.crt`, or should we have created a new CA from scratch?

How can we properly regenerate `http.p12` while ensuring it includes the necessary CA private key?

Also please confirm if it is the right process for cert renewal.

Any guidance on resolving this would be highly appreciated. Thanks!