# Do I have to restart Elasticsearch cluster if I replace CA certificate?

**URL:** <https://discuss.elastic.co/t/do-i-have-to-restart-elasticsearch-cluster-if-i-replace-ca-certificate/329927>\
**Category:** Kibana\
**Created:** [April 13, 2023, 12:54pm UTC](https://discuss.elastic.co/t/do-i-have-to-restart-elasticsearch-cluster-if-i-replace-ca-certificate/329927 "2023-04-13T12:54:02Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Petr.Simik](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/petr.simik/32/38082_2.png) [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\
**Post date:** [April 13, 2023, 12:54pm UTC](https://discuss.elastic.co/t/do-i-have-to-restart-elasticsearch-cluster-if-i-replace-ca-certificate/329927/1 "2023-04-13T12:54:02Z")

</div>

Hi,  
I have elasticsearch 8.6  
My certificate is going to expire so I followed the process where restart of cluster is required

> **[Update security certificates with a different CA | Elasticsearch Guide...](https://www.elastic.co/guide/en/elasticsearch/reference/master/update-node-certs-different.html)**
>
> ELSER is a learned sparse ranking model trained by Elastic.

however I have tested just simple file replacement of CA cert and it seems to work even without restarting of the cluster, however I am affraid id this might be a misleading information

the process:

1. execute GET \_ssl/certificates

```auto
[
  {
    "path": "elastic-certificates.p12",
    "format": "PKCS12",
    "alias": "ca",
    "subject_dn": "CN=Elastic Certificate Tool Autogenerated CA",
    "serial_number": "aaaa",
    "has_private_key": false,
    "expiry": "2023-05-05T04:38:48.000Z", <---- expiry of current cert
    "issuer": "CN=Elastic Certificate Tool Autogenerated CA"
  },

```

1. just copy new cert to /etc/elasticsearch/elastic-certificates.p12 no restart

2. execute GET \_ssl/certificates  
I receive information that it has new cert

```auto
[
  {
    "path": "elastic-certificates.p12",
    "format": "PKCS12",
    "alias": "ca",
    "subject_dn": "CN=Elastic Certificate Tool Autogenerated CA",
    "serial_number": "xxx",
    "has_private_key": false,
    "expiry": "2026-04-10T11:19:35.000Z", <---- see here new expiry
    "issuer": "CN=Elastic Certificate Tool Autogenerated CA"
  },
  {

```

the reason why I am copying keystore and truststore file (in my case the same file) is that is has been generated very long time ago and current process does not allow me to include new certificate into existing file

---

<div class="post-metadata">

**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\
**Post date:** [April 15, 2023, 3:29am UTC](https://discuss.elastic.co/t/do-i-have-to-restart-elasticsearch-cluster-if-i-replace-ca-certificate/329927/2 "2023-04-15T03:29:35Z")

</div>

Hello, I think might be more of an Elasticsearch question. Only part where I can help is the question about restarting the cluster: [Update certificates with the same CA | Elasticsearch Guide [master] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/master/update-node-certs-same.html#update-node-certs-same)  
It forces a new connection to use the new certificates. If you don't restart some long running connections could still be using the old one.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 13, 2023, 3:30am UTC](https://discuss.elastic.co/t/do-i-have-to-restart-elasticsearch-cluster-if-i-replace-ca-certificate/329927/3 "2023-05-13T03:30:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.