Unable to generate enrollment-token for new elasticsearch node

[fabio.virive]

When I use elasticsearch-create-enrollment-token -s node, to generate the token for enrol a new elastic node, I have the following error message:

Unable to create enrollment token for scope [node]

ERROR: Unable to create an enrollment token. Elasticsearch node HTTP layer SSL configuration Keystore doesn't contain any PrivateKey entries where the associated certificate is a CA certificate, with exit code 73

I see that there is this topic with the same issue:

Cannot create an enrollment token to enrol a new elasticsearch node

I have an elasticsearch 8.14 cluster running with 5 nodes with security enabled using own generated certificates. Everything is running fine but I now need to add 2 ingest only nodes. I am trying to create the enrollment token with: /usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s node But this is failing with: ERROR: Unable to create an enrollment token. Elasticsearch node HTTP layer SSL configuration Keystore doesn't contain any PrivateKey entries where the associated…

Anyway I use custom certificate, generated with my own CA for both transport and http layer.
I don't want to import the CA key in the elasticsearch trustore and I think is not a safe choice.

Is possible that this is a requirement?

[stephenb (Stephen Brown)]

Hi @fabio.virive Welcome to the community.

Since you are using your own certificates and manually configured the initial node you should not (can not) use the enrollment token method. That should only be used when you use the auto security method.

You need to Manually configure the node to join the cluster.

Elasticsearch-create-enrollment-token is not possible without a keystore ( aka with PEM certificates)

Hi @DavidDPD Welcome to the community, and apologies for the frustrating experience. Yes a bit frustrating and probably could be documented better. I think perhaps there is a fundamental "disconnect" At least this is how I understand it.... When you want to use your own certs etc, you are no longer using security auto configuration and thus when you use your own certs you should no longer be trying to "enroll" another node in the cluster using an enrollment token... the elasticsearch-create-…

[fabio.virive]

Hi @stephenb , thanks for your answer.
I can't find any documentation about manual configuration of additional node, do you can point me to some official documentation?

regards

[leandrojmp (Leandro Pereira)]

@fabio.virive

I can't find any documentation about manual configuration of additional node, do you can point me to some official documentation?

I don't think it exists, at least I could not find anything about it.

But the process is simple.

Basically you just need to generate the certificate for the new node and then change the relevant configurations in elasticsearch.yml , which are the xpack.security.* settings to point to the certificate.

The cluster.name needs to be the same and the setting discovery.seed_hosts needs to point to the current master eligible nodes.

If you share the elasticsearc.yml that you are using on the other nodes it would be easier to show what needs to be changed.