# Difference between HTTP and Transport certificates

**URL:** <https://discuss.elastic.co/t/difference-between-http-and-transport-certificates/327839>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security, docker\
**Created:** [March 16, 2023, 9:59am UTC](https://discuss.elastic.co/t/difference-between-http-and-transport-certificates/327839 "2023-03-16T09:59:44Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![divadpoc](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/divadpoc/32/97844_2.png) [@divadpoc](https://discuss.elastic.co/u/divadpoc)\
**Post date:** [March 16, 2023, 9:59am UTC](https://discuss.elastic.co/t/difference-between-http-and-transport-certificates/327839/1 "2023-03-16T09:59:44Z")

</div>

I've found this topic regarding automation of http certificate creation: [generate http certificate non interactive](https://discuss.elastic.co/t/generate-http-certificate-non-interactive/263685), as I was wondering the same thing: why can't I use the same advanced feature of using a `yaml` file containing all my relevant information in order to generate my certificates for HTTP.

I know the difference of `transport` and `http` layer. but I'm wondering:

- do they need to be different? (all the `docker-compose` examples are using the same for `http` and `transport`) if yes, why ?
- is there a difference when calling the `certutil` tool with `http` option and `cert` option? or can I just re-use the `cert` option for my http certificates ?

thank you in advance for your explanations and/or best practices.

EDIT: the `docker` tag was added automatically, but I'm not asking about docker deployment specifically!

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [March 16, 2023, 12:42pm UTC](https://discuss.elastic.co/t/difference-between-http-and-transport-certificates/327839/2 "2023-03-16T12:42:03Z")

</div>

> [@divadpoc](#):
>
> do they need to be different?

They don't, you can use the same certificates, however in some cases you should use different certificates for security.

For example, if you use a public CA like Let's encrypt to create your certificates and you your cluster is exposed on the internet, if you use the same certificate for `http` and `transport` anyone would be able to generate a certificate signed by the same CA and join a new node in your cluster.

> [@divadpoc](#):
>
> is there a difference when calling the `certutil` tool with `http` option and `cert` option? or can I just re-use the `cert` option for my http certificates ?

Not sure if there is any difference, I never used the `http` option, but you can just re-use the `cert` option to create new certificates.

---

<div class="post-metadata">

**Author:** ![divadpoc](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/divadpoc/32/97844_2.png) [@divadpoc](https://discuss.elastic.co/u/divadpoc)\
**Post date:** [March 16, 2023, 1:53pm UTC](https://discuss.elastic.co/t/difference-between-http-and-transport-certificates/327839/3 "2023-03-16T13:53:25Z")

</div>

thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 13, 2023, 1:53pm UTC](https://discuss.elastic.co/t/difference-between-http-and-transport-certificates/327839/4 "2023-04-13T13:53:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.