# Elasticsearch-certutil: generate both pem certificates and PKCS#12 keystores

**URL:** <https://discuss.elastic.co/t/elasticsearch-certutil-generate-both-pem-certificates-and-pkcs-12-keystores/255486>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [November 16, 2020, 10:03am UTC](https://discuss.elastic.co/t/elasticsearch-certutil-generate-both-pem-certificates-and-pkcs-12-keystores/255486 "2020-11-16T10:03:45Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![flavienbwk](https://avatars.discourse-cdn.com/v4/letter/f/5f9b8f/32.png) [@flavienbwk](https://discuss.elastic.co/u/flavienbwk)\
**Post date:** [November 16, 2020, 10:03am UTC](https://discuss.elastic.co/t/elasticsearch-certutil-generate-both-pem-certificates-and-pkcs-12-keystores/255486/1 "2020-11-16T10:03:45Z")

</div>

Hi,

I am currently using elasticsearch-certutil to generate my PEM certificates (.crt and .key) for Elasticsearch and Kibana through a certutil `.yml` file.

However I want to setup SSL for my Enterprise Search instance but it seems it doesn't accept PEM : it only accepts a `ent_search.ssl.keystore.path` option.

But certutil doesn't seem to accept an option to generate both PEM certificates and a PKCS keystore.

Here is the yml config :

```auto
instances:
    - name: es01
      dns:
        - es01 
        - localhost
      ip:
        - 127.0.0.1

    - name: es02
      dns:
        - es02
        - localhost
      ip:
        - 127.0.0.1

    - name: es03
      dns:
        - es03
        - localhost
      ip:
        - 127.0.0.1

    - name: kibana
      dns:
        - kibana
        - localhost
      ip:
        - 127.0.0.1

    - name: enterprise_search
      dns:
        - enterprise_search
        - localhost
      ip:
        - 127.0.0.1

```

Here is my command (in a Docker container) :

```auto
bin/elasticsearch-certutil cert --silent --pem --in config/certificates/instances.yml -out /certs/bundle.zip;

```

Am I forced to generate my Enterprise Search keystore through a second command and yml file ?

Thank you,

---

<div class="post-metadata">

**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\
**Post date:** [November 17, 2020, 12:35am UTC](https://discuss.elastic.co/t/elasticsearch-certutil-generate-both-pem-certificates-and-pkcs-12-keystores/255486/2 "2020-11-17T00:35:53Z")

</div>

It is not possible to generate both PEM and p12 files at the same time. Both elasticsearch and Kibana can support p12 file. So a possible solution to just generate p12 files across the board, i.e. drop the `--pem` CLI option.

Note it might not do what you expect if you run the command twice, one for pem and the other time for p12. The way you invoke certutil is to ask for a new CA to be generated on the fly on each invocation. That is, certificates generated from two invocations will not automatically trust each other since they are signed by different CA.

---

<div class="post-metadata">

**Author:** ![flavienbwk](https://avatars.discourse-cdn.com/v4/letter/f/5f9b8f/32.png) [@flavienbwk](https://discuss.elastic.co/u/flavienbwk)\
**Post date:** [November 17, 2020, 12:42am UTC](https://discuss.elastic.co/t/elasticsearch-certutil-generate-both-pem-certificates-and-pkcs-12-keystores/255486/3 "2020-11-17T00:42:57Z")

</div>

Thank you for this answer Yang\_Wang. I would like to keep crt.s and key.s for my Elasticsearch and Kibana instances.

What about doing something like this ?

```bash
# Generating CA certificate
bin/elasticsearch-certutil ca --silent --pem -out /certs/ca.zip;
unzip /certs/ca.zip -d /certs;

# Generating PEM certificates (ElasticSearch nodes and Kibana)
bin/elasticsearch-certutil cert --silent --pem --ca-cert "/certs/ca/ca.crt" --ca-key "/certs/ca/ca.key" --in config/certificates/pem.yml -out /certs/pem.zip;
unzip /certs/pem.zip -d /certs;

# Generating PKCS#12 certificates (Enterprise Search)
bin/elasticsearch-certutil cert --silent --pass "changeme" --ca-cert "/certs/ca/ca.crt" --ca-key "/certs/ca/ca.key" --in config/certificates/pkcs_12.yml -out /certs/pkcs_12.zip;
unzip /certs/pkcs_12.zip -d /certs;

```

Does this technique make sure both certs and keystore are signed by the same CA ?

Thanks,

---

<div class="post-metadata">

**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\
**Post date:** [November 17, 2020, 12:48am UTC](https://discuss.elastic.co/t/elasticsearch-certutil-generate-both-pem-certificates-and-pkcs-12-keystores/255486/4 "2020-11-17T00:48:08Z")

</div>

Yes that should work. We recommend to have a separate step for generating CA. In fact, generating CA on the fly will be [deprecated and removed in 8.0](https://github.com/elastic/elasticsearch/issues/61884).

---

<div class="post-metadata">

**Author:** ![flavienbwk](https://avatars.discourse-cdn.com/v4/letter/f/5f9b8f/32.png) [@flavienbwk](https://discuss.elastic.co/u/flavienbwk)\
**Post date:** [November 17, 2020, 1:00pm UTC](https://discuss.elastic.co/t/elasticsearch-certutil-generate-both-pem-certificates-and-pkcs-12-keystores/255486/5 "2020-11-17T13:00:38Z")

</div>

What do you mean by "generating the CA on the fly" ?

Isn't that command already a "separate step" for generating the CA ?

```auto
bin/elasticsearch-certutil ca --silent --pem -out /certs/ca.zip;

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 15, 2020, 1:00pm UTC](https://discuss.elastic.co/t/elasticsearch-certutil-generate-both-pem-certificates-and-pkcs-12-keystores/255486/6 "2020-12-15T13:00:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.