# ES Certutil - cert or ca? **URL:** \ **Category:** Elasticsearch\ **Created:** [July 13, 2018, 2:24pm UTC](https://discuss.elastic.co/t/es-certutil-cert-or-ca/139961 "2018-07-13T14:24:02Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![tdasch](https://avatars.discourse-cdn.com/v4/letter/t/58f4c7/32.png) [@tdasch](https://discuss.elastic.co/u/tdasch)\ **Post date:** [July 13, 2018, 2:24pm UTC](https://discuss.elastic.co/t/es-certutil-cert-or-ca/139961/1 "2018-07-13T14:24:02Z")
I am using [this blog post](https://www.elastic.co/blog/how-to-setup-tls-for-elasticsearch-kibana-logstash-filebeat-with-offline-install-in-linux) to setup TLS/SSL for my cluster. It's a great post and it's worked well for me, but i'm going back through it with a finer tooth comb to better understand what I am actually doing and what is being done. At the point in the blog where you use Certutil this is the input: `[root@node1 elasticsearch]# bin/x-pack/certutil cert ca --pem --in ~/tmp/cert_blog/instance.yml --out ~/tmp/cert_blog/certs.zip` It looks like both parameters `cert` and `ca` are being used, but the [doc on certutil](https://www.elastic.co/guide/en/elasticsearch/reference/6.3/certutil.html#_parameters_12) states you can't do that (see below). I must be missing something. Could someone explain what I am missing. Thanks! ``` ca Specifies to generate a new local certificate authority (CA). This parameter cannot be used with the csr or cert parameters. cert Specifies to generate new X.509 certificates and keys. This parameter cannot be used with the csr or ca parameters. ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 10, 2018, 2:24pm UTC](https://discuss.elastic.co/t/es-certutil-cert-or-ca/139961/2 "2018-08-10T14:24:03Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.