# Unable to generate enrollment-token for new elasticsearch node

**URL:** <https://discuss.elastic.co/t/unable-to-generate-enrollment-token-for-new-elasticsearch-node/378234>\
**Category:** Elasticsearch\
**Created:** [May 16, 2025, 2:20pm UTC](https://discuss.elastic.co/t/unable-to-generate-enrollment-token-for-new-elasticsearch-node/378234 "2025-05-16T14:20:25Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [May 17, 2025, 12:42am UTC](https://discuss.elastic.co/t/unable-to-generate-enrollment-token-for-new-elasticsearch-node/378234/2 "2025-05-17T00:42:01Z")

</div>

Hi @fabio.virive Welcome to the community.

Since you are using your own certificates and manually configured the initial node you should not (can not) use the enrollment token method. That should only be used when you use the auto security method.

You need to Manually configure the node to join the cluster.

> [@Elasticsearch-create-enrollment-token is not possible without a keystore ( aka with PEM certificates)](https://discuss.elastic.co/t/elasticsearch-create-enrollment-token-is-not-possible-without-a-keystore-aka-with-pem-certificates/336136/2):
>
> Hi @DavidDPD Welcome to the community, and apologies for the frustrating experience. Yes a bit frustrating and probably could be documented better. I think perhaps there is a fundamental "disconnect" At least this is how I understand it.... When you want to use your own certs etc, you are no longer using security auto configuration and thus when you use your own certs you should no longer be trying to "enroll" another node in the cluster using an enrollment token... the elasticsearch-create-…

---

_[View the full topic](https://discuss.elastic.co/t/unable-to-generate-enrollment-token-for-new-elasticsearch-node/378234)._