# Elasticsearch 7.6 TLS/SSl Organization signing certificate **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [April 7, 2020, 8:03pm UTC](https://discuss.elastic.co/t/elasticsearch-7-6-tls-ssl-organization-signing-certificate/227003 "2020-04-07T20:03:08Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Ahmed\_Abdulaleem](https://avatars.discourse-cdn.com/v4/letter/a/90ced4/32.png) [@Ahmed\_Abdulaleem](https://discuss.elastic.co/u/Ahmed_Abdulaleem)\ **Post date:** [April 7, 2020, 8:03pm UTC](https://discuss.elastic.co/t/elasticsearch-7-6-tls-ssl-organization-signing-certificate/227003/1 "2020-04-07T20:03:08Z")
Dears, Kindly, I need your support where elastic search 7.6 documentation does not cover using an organization signing certificate . 1. if I use my organization signing certificate does the generated CSR's by certutils should contain public IP's and public DNS's or can I use our private IP 's, local DNS's (Elasticsearch nodes private not public) 2. is the xpack.security.transport.ssl.certificate\_authorities a mandatory where my organization can not provide me with it's CA. ```auto xpack.security.transport.ssl.enabled: true xpack.security.transport.ssl.verification_mode: full xpack.security.transport.ssl.key: /etc/elasticsearch/node01.key xpack.security.transport.ssl.certificate: /etc/elasticsearch/node01.pem #xpack.security.transport.ssl.certificate_authorities: [/etc/elasticsearch/node01.pem"] ``` ---
**Author:** ![Ahmed\_Abdulaleem](https://avatars.discourse-cdn.com/v4/letter/a/90ced4/32.png) [@Ahmed\_Abdulaleem](https://discuss.elastic.co/u/Ahmed_Abdulaleem)\ **Post date:** [April 9, 2020, 11:40am UTC](https://discuss.elastic.co/t/elasticsearch-7-6-tls-ssl-organization-signing-certificate/227003/2 "2020-04-09T11:40:34Z")
Hello @ikakavas, please can you advise me regarding this question ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [April 9, 2020, 11:58am UTC](https://discuss.elastic.co/t/elasticsearch-7-6-tls-ssl-organization-signing-certificate/227003/3 "2020-04-09T11:58:21Z")
Thanks very much for your interest in Elasticsearch. Please be patient in waiting for responses to your question and refrain from pinging multiple times asking for a response or opening multiple topics for the same question. This is a community forum, it may take time for someone to reply to your question. For more information please refer to the [Community Code of Conduct](https://www.elastic.co/community/codeofconduct) specifically the section "Be patient". Also, please refrain from pinging folks directly, this is a forum and anyone that participates might be able to assist you. If you are in need of a service with an SLA that covers response times for questions then you may want to consider talking to us about a [subscription](https://www.elastic.co/subscriptions). ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [April 9, 2020, 12:06pm UTC](https://discuss.elastic.co/t/elasticsearch-7-6-tls-ssl-organization-signing-certificate/227003/4 "2020-04-09T12:06:09Z")
> [@Ahmed\_Abdulaleem](#): > > if I use my organization signing certificate does the generated CSR's by certutils should contain public IP's and public DNS's or can I use our private IP 's, local DNS's (Elasticsearch nodes private not public) There is no difference whether you sign this with an Organization CA or a public CA. Maybe I misunderstood your question, but why would that matter ? > is the xpack.security.transport.ssl.certificate\_authorities a mandatory where my organization can not provide me with it's CA. Yes it is. The CA certificate is meant to be public and distributed to entities so that they can verify the certificates that this CA is signing, so in order to use certificates that are signed by this CA, you either need this CA certificate or you need to disable certificate verification which is highly discouraged. ---
**Author:** ![Ahmed\_Abdulaleem](https://avatars.discourse-cdn.com/v4/letter/a/90ced4/32.png) [@Ahmed\_Abdulaleem](https://discuss.elastic.co/u/Ahmed_Abdulaleem)\ **Post date:** [April 9, 2020, 9:38pm UTC](https://discuss.elastic.co/t/elasticsearch-7-6-tls-ssl-organization-signing-certificate/227003/5 "2020-04-09T21:38:20Z")
Thank You very much @ikakavas ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 7, 2020, 9:38pm UTC](https://discuss.elastic.co/t/elasticsearch-7-6-tls-ssl-organization-signing-certificate/227003/6 "2020-05-07T21:38:21Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.