# Expired ca.crt/nodes certificates - how to renew such certificates?

**URL:** https://discuss.elastic.co/t/expired-ca-crt-nodes-certificates-how-to-renew-such-certificates/339114
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [July 24, 2023, 2:37pm UTC](https://discuss.elastic.co/t/expired-ca-crt-nodes-certificates-how-to-renew-such-certificates/339114 "2023-07-24T14:37:25Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![Opster\_support](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/opster_support/32/56687_2.png) [@Opster\_support](https://discuss.elastic.co/u/Opster_support)
#### Post date: [July 24, 2023, 5:41pm UTC](https://discuss.elastic.co/t/expired-ca-crt-nodes-certificates-how-to-renew-such-certificates/339114/2 "2023-07-24T17:41:31Z")

</div>

To renew your expired certificates, you can follow these steps:

1. Generate a new CA certificate and key using the `elasticsearch-certutil` tool. You can use the following command:

```shell
bin/elasticsearch-certutil ca --pem --days <validity_days> --out <output_directory>/ca.zip

```

Replace `<validity_days>` with the number of days you want the certificate to be valid for, and `<output_directory>` with the directory where you want to save the new CA certificate.

1. Unzip the `ca.zip` file. You will find the new CA certificate and key in the `ca` directory.

2. Generate new node certificates using the new CA certificate and key. You can use the following command:

```shell
bin/elasticsearch-certutil cert --ca-cert <path_to_ca_certificate> --ca-key <path_to_ca_key> --pem --days <validity_days> --out <output_directory>/certs.zip

```

Replace `<path_to_ca_certificate>` and `<path_to_ca_key>` with the paths to the new CA certificate and key, `<validity_days>` with the number of days you want the certificates to be valid for, and `<_directory>` with the directory where you want to save the new node certificates.

1. Unzip the `certs.zip` file. You will find the new node certificates in the `certs` directory.

2. Replace the old CA certificate and node certificates with the new ones in your Elasticsearch configuration.

3. Restart your Elasticsearch nodes for the changes to take effect.

4. Replace the old CA certificate with the new one in your Filebeat and Logstash configurations.

5. Restart your Filebeat and Logstash instances for the changes to take effect.

Remember to distribute the new CA certificate to all external Filebeat instances that connect to Logstash. They will need the new CA certificate to verify the identity of Logstash.

Please note that this process will cause downtime for your Elasticsearch cluster and Filebeat and Logstash instances. You should plan this operation during a maintenance window.

Disclaimer, OpsGPT assisted me with this answer.

---

_[View the full topic](https://discuss.elastic.co/t/expired-ca-crt-nodes-certificates-how-to-renew-such-certificates/339114)._