anchor.diff:  `--cacert`::
   Path to the generated `http_ca.crt` certificate for the HTTP layer.
   
  -. In your new terminal, navigate to the directory where you installed {es}, and
  -run the <<create-enrollment-token,`elasticsearch-create-enrollment-token`>> tool
  -to generate an enrollment token for {kib}.
  +. From the directory where you installed {kib}, start {kib}.
   +
   [source,shell]
   ----
  -bin/elasticsearch-create-enrollment-token -s kibana
  -----
  -+
  -Copy the enrollment token, which you'll use to enroll {kib} with your {es}
  -cluster.
  -
  -. From the directory where you installed {kib}, start {kib} in interactive mode.
  -+
  -[source,shell]
  -----
  -bin/kibana --interactiveSetup.enabled=true
  +bin/kibana
   ----
   +
   This command generates a unique link to enroll your {kib} instance with {es}.
  
positive.code: Copy the enrollment token, which you'll use to enroll additional nodes with
  your {es} cluster.
  
  . From the installation directory of your other node, run the
  `elasticsearch-enroll-node` tool and pass your enrollment token with the
  `--enrollment token` parameter.
  +
  [source,shell]
  ----
  bin/elasticsearch-enroll-node --enrollment token <enrollment-token>
  ----
  
  . Repeat the previous step for any additional nodes that you want to enroll.
  
  . Start your new nodes, which {es} automatically enrolls into the existing
  cluster.
  +
  [source,shell]
  ----
  bin/elasticsearch
  ----
  
  [discrete]
  === What's next?
  Congratulations! You've successfully started the {stack} with security enabled. {es}
  and {kib} are secured with TLS on the HTTP layer, and internode communication
  is encrypted. If you want to enable HTTPS for web traffic, you
  can <<encrypt-kibana-browser,encrypt traffic between your browser and {kib}>>.
  
negative.code: [[configuring-stack-security]]
  == Start the Elastic Stack with security enabled
  
  beta::[This functionality is in beta and is subject to change. The design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features.]
  
  When you start {es} for the first time, the following security configuration
  occurs automatically:
  
  * <<stack-security-certificates,Certificates and keys>> for TLS are
  generated for the transport and HTTP layers.
  * The TLS configuration settings are written to `elasticsearch.yml`.
  * A password is generated for the `elastic` user.
  * An enrollment token is generated for {kib}.
  
  You can then start {kib} and enter the enrollment token, which is valid for 30
  minutes. This token automatically applies the security settings from your {es} 
  cluster, authenticates to {es} with the built-in `kibana` service account, and writes the 
  security configuration to `kibana.yml`. 
  
  [discrete]
  === Prerequisites
  
  * https://www.elastic.co/downloads/elasticsearch#preview-release[Download] and
  unpack the `elasticsearch 8.0.0-beta` package distribution for your
  environment.
  * https://www.elastic.co/downloads/kibana#preview-release[Download] and unpack
  the `kibana 8.0.0-beta` package distribution for your environment.
  
  [discrete]
  [[stack-start-with-security]]
  === Start {es} and enroll {kib} with security enabled
  
  . From the installation directory, start {es}. A password is generated for the 
  `elastic` user and output to the terminal, plus an enrollment token for
  enrolling {kib}.
  +
  [source,shell]
  ----
  bin/elasticsearch
  ----
  +
  TIP: You might need to scroll back a bit in the terminal to view the password
  and enrollment token.
  
  . Copy the generated password and enrollment token and save them in a secure
  location. These values are shown only when you start {es} for the first time.
  +
  NOTE: If you need to reset the password for the `elastic` user or other
  built-in users, run the <<reset-password,`elasticsearch-reset-password`>> tool.
  This tool is available in the {es} `/bin` directory.
  
  . (Optional) Open a new terminal and verify that you can connect to your {es} 
  cluster by making an authenticated call. Enter the password for the `elastic` 
  user when prompted:
  +
  [source,shell]
  ----
  