# Changing Certificate with New CA on Elasticsearch Cluster

**URL:** <https://discuss.elastic.co/t/changing-certificate-with-new-ca-on-elasticsearch-cluster/345297>\
**Category:** Elasticsearch\
**Created:** [October 18, 2023, 2:05pm UTC](https://discuss.elastic.co/t/changing-certificate-with-new-ca-on-elasticsearch-cluster/345297 "2023-10-18T14:05:51Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![yvangarc](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yvangarc/32/126168_2.png) [@yvangarc](https://discuss.elastic.co/u/yvangarc)\
**Post date:** [October 18, 2023, 2:05pm UTC](https://discuss.elastic.co/t/changing-certificate-with-new-ca-on-elasticsearch-cluster/345297/1 "2023-10-18T14:05:51Z")

</div>

Hello,

We have an elasticsearch cluster with version 8.5.1, in a baremetal kubernetes cluster, and we have the need to change the CA and certificates of the cluster nodes.

I've already created the new CA and certificate for the nodes and created a secret in kubernetes with them, which is how the old certificate is. And in theory, update the new certificate is simple, changing the secret of the old certificate to the secret of the new one in the volumemount of the elastic statefulset.

The problem is that this causes the rollingupdate node by node, and the first node that is restarted, having a different certificate than the rest of the cluster, never joins, so I have had to reverse.

Note that we have a cluster of 3 masters and 5 data nodes, with a statefulset for both types of nodes. With this configuration, I would appreciate it if somebody could help me with the procedure to be able to change the certificate satisfactorily.

Regards

---

<div class="post-metadata">

**Author:** ![Alexis\_Roberson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alexis_roberson/32/113233_2.png) [@Alexis\_Roberson](https://discuss.elastic.co/u/Alexis_Roberson)\
**Post date:** [October 18, 2023, 2:58pm UTC](https://discuss.elastic.co/t/changing-certificate-with-new-ca-on-elasticsearch-cluster/345297/2 "2023-10-18T14:58:13Z")

</div>

Hi @yvangarc  
Perhaps the nodes are not trusting the new certificate chain. Maybe this [thread](https://github.com/elastic/cloud-on-k8s/issues/6574) would be a bit helpful for your issue.

---

<div class="post-metadata">

**Author:** ![yvangarc](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yvangarc/32/126168_2.png) [@yvangarc](https://discuss.elastic.co/u/yvangarc)\
**Post date:** [October 27, 2023, 11:19am UTC](https://discuss.elastic.co/t/changing-certificate-with-new-ca-on-elasticsearch-cluster/345297/3 "2023-10-27T11:19:53Z")

</div>

Finally i was able to do it in several steps:

Firstly, only add the newca to the secret that stores the certificates and setting:

```auto
- name: xpack.security.transport.ssl.certificate_authorities
  value: '["oldca", "newca"]'

```

Once the cluster trust the new CA, i can change the transport certificate of the all nodes keeping both CAs in the cluster trusted certificate\_authorities

And finally, you can remove the old CA from the cluster trusted certificate\_authorities.

Regards

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 24, 2023, 11:20am UTC](https://discuss.elastic.co/t/changing-certificate-with-new-ca-on-elasticsearch-cluster/345297/4 "2023-11-24T11:20:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.