# Can I use these step to generate elastic search root-ca.pem **URL:** \ **Category:** Elasticsearch\ **Created:** [February 14, 2024, 7:33am UTC](https://discuss.elastic.co/t/can-i-use-these-step-to-generate-elastic-search-root-ca-pem/353238 "2024-02-14T07:33:38Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![fahim2024](https://avatars.discourse-cdn.com/v4/letter/f/bc8723/32.png) [@fahim2024](https://discuss.elastic.co/u/fahim2024)\ **Post date:** [February 14, 2024, 7:33am UTC](https://discuss.elastic.co/t/can-i-use-these-step-to-generate-elastic-search-root-ca-pem/353238/1 "2024-02-14T07:33:38Z")
./elasticsearch-certutil ca ./elasticsearch-certutil cert --ca elastic-stack-ca.p12 openssl pkcs12 -in elastic-certificates.p12 -clcerts -nokeys -out certificate.pem openssl pkcs12 -in elastic-certificates.p12 -nocerts -out key.pem openssl pkcs12 -in elastic-certificates.p12 -cacerts -nokeys -out root-ca.pem ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [February 15, 2024, 1:20am UTC](https://discuss.elastic.co/t/can-i-use-these-step-to-generate-elastic-search-root-ca-pem/353238/2 "2024-02-15T01:20:02Z")
You can, but it's pretty cumbersome. certutil can write files in PEM format (`--pem` option) if that's what you want. Or if you're comfortable using openssl, you can just use that for everything. There's no need to use certutil if you don't want to. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 14, 2024, 1:20am UTC](https://discuss.elastic.co/t/can-i-use-these-step-to-generate-elastic-search-root-ca-pem/353238/3 "2024-03-14T01:20:41Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.