# Creating ES Node Certs Without CA Key?

**URL:** <https://discuss.elastic.co/t/creating-es-node-certs-without-ca-key/250065>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [September 26, 2020, 9:08pm UTC](https://discuss.elastic.co/t/creating-es-node-certs-without-ca-key/250065 "2020-09-26T21:08:56Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kevin\_f](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kevin_f/32/72456_2.png) [@Kevin\_f](https://discuss.elastic.co/u/Kevin_f)\
**Post date:** [September 26, 2020, 9:08pm UTC](https://discuss.elastic.co/t/creating-es-node-certs-without-ca-key/250065/1 "2020-09-26T21:08:56Z")

</div>

Hello,

I was wondering if it was possible to create ES node certs using an existing CA without a CA key? The only thing I have found in the documentation is that you can only create ES node certs with existing CA if it has the CA key. Which is done by using the example command:

```auto
/usr/share/elasticsearch/bin/elasticsearch-certutil cert --ca-cert <path/to/ca.crt> --ca-key <path/to/ca.key> --pem --in <path/to/file.yml> --out <path/to/file.zip>

```

The reason I ask is because our ES node TLS certs are expiring however our CA cert is still valid for another 2 years but does not seem to have a CA key.

If there is a way to achieve this without having to re-create a new CA cert inorder to just get a CA key, then can someone please assist?

Thanks.

---

<div class="post-metadata">

**Author:** ![Albert\_Zaharovits](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/albert_zaharovits/32/24390_2.png) [@Albert\_Zaharovits](https://discuss.elastic.co/u/Albert_Zaharovits)\
**Post date:** [September 29, 2020, 4:07pm UTC](https://discuss.elastic.co/t/creating-es-node-certs-without-ca-key/250065/2 "2020-09-29T16:07:56Z")

</div>

> I was wondering if it was possible to create ES node certs using an existing CA without a CA key?

This is not possible. The CA certificate is public, if it were possible than anyone on the internet could've created valid certs and join your cluster.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 27, 2020, 4:08pm UTC](https://discuss.elastic.co/t/creating-es-node-certs-without-ca-key/250065/3 "2020-10-27T16:08:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.