Needed explanation for keystore's PrivateKey entries

HarimbolaSantatra
Wed, 30 Jul 2025 17:15:16 +0000
Elasticsearch

I encountered the following issue when I try to enroll a token for Kibana:

$ ./bin/elasticsearch-create-enrollment-token --scope kibana
Unable to create enrollment token for scope [kibana]

ERROR: Unable to create an enrollment token. Elasticsearch node HTTP layer SSL configuration Keystore doesn't contain any PrivateKey entries where the associated certificate is a CA certificate, with exit code 73

So I found this thread.

When I follow the author's instruction, after the command

./jdk/bin/keytool -importkeystore -destkeystore /etc/elasticsearch/certs/new-keystore.p12 -srckeystore /etc/elasticsearch/certs/http.p12  -srcstoretype PKCS12

, it yields the error:

keytool error: java.security.UnrecoverableKeyException: Get Key failed: Given final block not properly padded. Such issues can arise if a bad key is used during decryption

Another post suggests me to set
xpack.security.transport.ssl.keystore.secure_password and xpack.security.transport.ssl.truststore.secure_password.

But at this point, I want to understand what is really going on.

What does the error "Elasticsearch node HTTP layer SSL configuration Keystore doesn't contain any PrivateKey entries where the associated certificate is a CA certificate" really mean ?

I don't understand since when I do keytool -keystore /etc/elasticsearch/certs/http.ca -list, it shows that I have one entry PrivateKeyEntry:

Your keystore contains 1 entry

http, Jul 5, 2025, PrivateKeyEntry,
Certificate chain length: 0

Continuing the discussion from Import CA Cert as PrivateKeyEntry to HTTP Keystore - Solve Unable to create enrollment token Error, the author wrote that:

Import CA Cert as PrivateKeyEntry to HTTP Keystore - Solve Unable to create enrollment token Error

This step changes the CA Cert that was automatically imported into the original HTTP Keystore as TrustCertEntry to PrivateKeyEntry, and this is exactly what that ERROR tells us to do.

... but I still does not understand that sentence.

Thank you!

8 posts - 4 participants