# Expired ca.crt/nodes certificates - how to renew such certificates?

**URL:** https://discuss.elastic.co/t/expired-ca-crt-nodes-certificates-how-to-renew-such-certificates/339114
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [July 24, 2023, 2:37pm UTC](https://discuss.elastic.co/t/expired-ca-crt-nodes-certificates-how-to-renew-such-certificates/339114 "2023-07-24T14:37:25Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![d.silwon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/d.silwon/32/65853_2.png) [@d.silwon](https://discuss.elastic.co/u/d.silwon)
#### Post date: [July 24, 2023, 2:37pm UTC](https://discuss.elastic.co/t/expired-ca-crt-nodes-certificates-how-to-renew-such-certificates/339114/1 "2023-07-24T14:37:26Z")

</div>

Dears,

To secure our ELK cluster we are using self-signed certificates generated by elasticsearch-certutil tool. Our ca.crt and certificates of nodes expired.  
I would like to mention that many external filebeats connect to logstash and also use this ca.crt  
What is the procedure to renew such certificates?

Best Regards,  
Dan

---

<div class="post-metadata">

### Author: ![Opster\_support](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/opster_support/32/56687_2.png) [@Opster\_support](https://discuss.elastic.co/u/Opster_support)
#### Post date: [July 24, 2023, 5:41pm UTC](https://discuss.elastic.co/t/expired-ca-crt-nodes-certificates-how-to-renew-such-certificates/339114/2 "2023-07-24T17:41:31Z")

</div>

To renew your expired certificates, you can follow these steps:

1. Generate a new CA certificate and key using the `elasticsearch-certutil` tool. You can use the following command:

```shell
bin/elasticsearch-certutil ca --pem --days <validity_days> --out <output_directory>/ca.zip

```

Replace `<validity_days>` with the number of days you want the certificate to be valid for, and `<output_directory>` with the directory where you want to save the new CA certificate.

1. Unzip the `ca.zip` file. You will find the new CA certificate and key in the `ca` directory.

2. Generate new node certificates using the new CA certificate and key. You can use the following command:

```shell
bin/elasticsearch-certutil cert --ca-cert <path_to_ca_certificate> --ca-key <path_to_ca_key> --pem --days <validity_days> --out <output_directory>/certs.zip

```

Replace `<path_to_ca_certificate>` and `<path_to_ca_key>` with the paths to the new CA certificate and key, `<validity_days>` with the number of days you want the certificates to be valid for, and `<_directory>` with the directory where you want to save the new node certificates.

1. Unzip the `certs.zip` file. You will find the new node certificates in the `certs` directory.

2. Replace the old CA certificate and node certificates with the new ones in your Elasticsearch configuration.

3. Restart your Elasticsearch nodes for the changes to take effect.

4. Replace the old CA certificate with the new one in your Filebeat and Logstash configurations.

5. Restart your Filebeat and Logstash instances for the changes to take effect.

Remember to distribute the new CA certificate to all external Filebeat instances that connect to Logstash. They will need the new CA certificate to verify the identity of Logstash.

Please note that this process will cause downtime for your Elasticsearch cluster and Filebeat and Logstash instances. You should plan this operation during a maintenance window.

Disclaimer, OpsGPT assisted me with this answer.

---

<div class="post-metadata">

### Author: ![d.silwon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/d.silwon/32/65853_2.png) [@d.silwon](https://discuss.elastic.co/u/d.silwon)
#### Post date: [July 24, 2023, 6:17pm UTC](https://discuss.elastic.co/t/expired-ca-crt-nodes-certificates-how-to-renew-such-certificates/339114/3 "2023-07-24T18:17:02Z")

</div>

@Opster_support thanks for your answer.

I have additional question regarding to filebeats clients. I understand that client certificates don't need to be re-created. Just replace the ca certificate only on clients machines and restart filebeat service. Am I right?

---

<div class="post-metadata">

### Author: ![Opster\_support](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/opster_support/32/56687_2.png) [@Opster\_support](https://discuss.elastic.co/u/Opster_support)
#### Post date: [July 25, 2023, 1:20pm UTC](https://discuss.elastic.co/t/expired-ca-crt-nodes-certificates-how-to-renew-such-certificates/339114/4 "2023-07-25T13:20:37Z")

</div>

@d.silwon Yes, you're correct. If you're only updating the Certificate Authority (CA) certificate, you don't need to recreate the client certificates. You just need to replace the CA certificate on the client machines and restart the Filebeat service. However, please ensure that the client certificates were originally signed by the CA that you're updating. If not, you'll need to recreate and replace them as well.

---

<div class="post-metadata">

### Author: ![d.silwon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/d.silwon/32/65853_2.png) [@d.silwon](https://discuss.elastic.co/u/d.silwon)
#### Post date: [July 25, 2023, 2:39pm UTC](https://discuss.elastic.co/t/expired-ca-crt-nodes-certificates-how-to-renew-such-certificates/339114/5 "2023-07-25T14:39:40Z")

</div>

@Opster_support Clients certificates were signed by expired CA. Thanks a lot for your involvement and assistance.

Best Regards,  
Dan

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 22, 2023, 2:40pm UTC](https://discuss.elastic.co/t/expired-ca-crt-nodes-certificates-how-to-renew-such-certificates/339114/6 "2023-08-22T14:40:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.