Elasticsearch Rolling Restart


I need to perform a rolling restart of my elasticsearch cluster which contains 3 master nodes and 7 data nodes. I believe a rolling restart is the best approach for patching and also cert renewals. From this documentation:

it does not state which sequence to perform the rolling restart. Do I start with the master nodes or data nodes first? Anyone has done this before or know what is the safe way?