# Elasticsearch didn't create ca.key. How can i create new key/crt for new instances?

**URL:** <https://discuss.elastic.co/t/elasticsearch-didnt-create-ca-key-how-can-i-create-new-key-crt-for-new-instances/215479>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [January 17, 2020, 2:48pm UTC](https://discuss.elastic.co/t/elasticsearch-didnt-create-ca-key-how-can-i-create-new-key-crt-for-new-instances/215479 "2020-01-17T14:48:19Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kosodrom](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kosodrom/32/99278_2.png) [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\
**Post date:** [January 17, 2020, 2:48pm UTC](https://discuss.elastic.co/t/elasticsearch-didnt-create-ca-key-how-can-i-create-new-key-crt-for-new-instances/215479/1 "2020-01-17T14:48:19Z")

</div>

Hi guys,

I've used this documentation to encrypt the communication in the ELK (7.4.0) cluster: [https://www.elastic.co/blog/configuring-ssl-tls-and-https-to-secure-elasticsearch-kibana-beats-and-logstash](https://www.elastic.co/blog/configuring-ssl-tls-and-https-to-secure-elasticsearch-kibana-beats-and-logstash)

especially this command: `bin/elasticsearch-certutil cert ca --pem --in ~/tmp/cert_blog/instance.yml --out ~/tmp/cert_blog/certs.zip`

The output of it is a zip file, which contains key/crt for every node and root ca.crt (without ca.key)

Now i would like to create new key/crt for a filebeat instance, but I can't because ca.key is required (read her: [https://www.elastic.co/guide/en/elasticsearch/reference/current/certutil.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/certutil.html)), but it has not been created.

How can I now create new certificates for new nodes?

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [January 20, 2020, 7:44am UTC](https://discuss.elastic.co/t/elasticsearch-didnt-create-ca-key-how-can-i-create-new-key-crt-for-new-instances/215479/2 "2020-01-20T07:44:19Z")

</div>

> [@Kosodrom](#):
>
> How can I now create new certificates for new nodes?

I'm afraid that you can't.  
The instructions that you followed do not keep a copy of the CA key, so it is not possible to add new certificates.

I'll see what I can do to update that blog post with a warning, or additional instructions to retain the CA key, because I do not recommend creating a throw-away CA like that.

---

<div class="post-metadata">

**Author:** ![Kosodrom](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kosodrom/32/99278_2.png) [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\
**Post date:** [January 20, 2020, 9:48am UTC](https://discuss.elastic.co/t/elasticsearch-didnt-create-ca-key-how-can-i-create-new-key-crt-for-new-instances/215479/3 "2020-01-20T09:48:03Z")

</div>

Thank you for the reply. It means to me that I have to recreate the CA (now with --keep-ca-key parameter) and certificates/keys and exchange all certificates and keys on the ELK nodes.

After that i can use ca.crt and ca.key file to create new certificates/keys for example for beats or new cluster nodes.

Can you explain why you "do not recommend creating a throw-away CA like that".

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 17, 2020, 9:48am UTC](https://discuss.elastic.co/t/elasticsearch-didnt-create-ca-key-how-can-i-create-new-key-crt-for-new-instances/215479/4 "2020-02-17T09:48:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.