anchor.diff:  Copy the enrollment token, which you'll use to enroll additional nodes with
   your {es} cluster.
   
  -. From the installation directory of your other node, run the
  -`elasticsearch-enroll-node` tool and pass your enrollment token with the
  -`--enrollment token` parameter.
  +. From the installation directory of your other node, start {es} and pass the
  +enrollment token with the `--enrollment-token` parameter.
   +
   [source,shell]
   ----
  -bin/elasticsearch-enroll-node --enrollment token <enrollment-token>
  +bin/elasticsearch --enrollment-token <enrollment-token>
   ----
  ++
  +{es} automatically generates certificates and keys in the
  +`config/tls_auto_config_node_<timestamp>` directory.
   
   . Repeat the previous step for any additional nodes that you want to enroll.
   
  -. Start your new nodes, which {es} automatically enrolls into the existing
  -cluster.
  -+
  -[source,shell]
  -----
  -bin/elasticsearch
  -----
  +[discrete]
  +=== What's next?
  +Congratulations! You've successfully started the {stack} with security enabled.
  +{es} and {kib} are secured with TLS on the HTTP layer, and internode
  +communication is encrypted. If you want to enable HTTPS for web traffic, you
  +can <<encrypt-kibana-browser,encrypt traffic between your browser and {kib}>>.
   
   [discrete]
  -=== What's next?
  -Congratulations! You've successfully started the {stack} with security enabled. {es}
  -and {kib} are secured with TLS on the HTTP layer, and internode communication
  -is encrypted. If you want to enable HTTPS for web traffic, you
  -can <<encrypt-kibana-browser,encrypt traffic between your browser and {kib}>>.
  +[[stack-security-certificates]]
  +=== Security certificates and keys
  +
  +When you start {es} for the first time, the following certificates and keys are
  +generated in the `config/tls_auto_config_<timestamp>` directory,
  +which are used to connect a {kib} instance to your secured {es} cluster and
  +to encrypt internode communication. The files are listed here for reference.
  +
  +`http_ca.crt`::
  +The CA certificate that is used to sign the certificates for the HTTP layer of
  +this {es} cluster.
  +
  +`http_keystore_local_node.p12`::
  +Keystore that contains the key and certificate for the HTTP layer for this node.
  +
  +`transport_keystore_all_nodes.p12`::
  +Keystore that contains the key and certificate for the transport layer for all
  +the nodes in your cluster.
  +
  +Additionally, when you use the enrollment token to connect {kib} to a secured {es} cluster, a security certificate is retrieved from {es} and stored in the
  +{kib} `/data` directory. This file establishes trust between {kib} and the {es}
  +Certificate Authority (CA) for the HTTP layer.
positive.code: `--cacert`::
  Path to the generated `http_ca.crt` certificate for the HTTP layer.
  
  . In your new terminal, navigate to the directory where you installed {es}, and
  run the <<create-enrollment-token,`elasticsearch-create-enrollment-token`>> tool
  to generate an enrollment token for {kib}.
  +
  [source,shell]
  ----
  bin/elasticsearch-create-enrollment-token -s kibana
  ----
  +
  Copy the enrollment token, which you'll use to enroll {kib} with your {es}
  cluster.
  
  . From the directory where you installed {kib}, start {kib} in interactive mode.
  +
  [source,shell]
  ----
  bin/kibana --interactiveSetup.enabled=true
  ----
  +
  This command generates a unique link to enroll your {kib} instance with {es}.
  
negative.code: [discrete]
  [[stack-enroll-nodes]]
  === Enroll additional nodes in your cluster
  
  . In a separate terminal from where {es} is running, navigate to the directory
  where you installed {es} and run the
  <<create-enrollment-token,`elasticsearch-create-enrollment-token`>> tool
  