# Extend the expiry of the certificates
**URL:** https://discuss.elastic.co/t/extend-the-expiry-of-the-certificates/346548
**Category:** Elasticsearch
**Created:** [November 6, 2023, 6:01pm UTC](https://discuss.elastic.co/t/extend-the-expiry-of-the-certificates/346548 "2023-11-06T18:01:25Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@smiley\_tamy](https://discuss.elastic.co/u/smiley_tamy)
#### Post date: [November 6, 2023, 6:01pm UTC](https://discuss.elastic.co/t/extend-the-expiry-of-the-certificates/346548/1 "2023-11-06T18:01:25Z")
Hi, we have enabled security for Elasticsearch.
We extended the expiry of certificates.
But still instance certificate does not get changed and retains the default expiry of 3 years
Is there a way to make it work
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [November 7, 2023, 4:54am UTC](https://discuss.elastic.co/t/extend-the-expiry-of-the-certificates/346548/2 "2023-11-07T04:54:31Z")
You need to provide a lot more details if you want us to help you. We cannot guess what is going on, you need to tell us.
> [@smiley\_tamy](#):
>
> We extended the expiry of certificates.
What exactly did you do?
> [@smiley\_tamy](#):
>
> But still instance certificate does not get changed and retains the default expiry of 3 years
What exactly did you do to check this expiry?
---
### Author:  [@smiley\_tamy](https://discuss.elastic.co/u/smiley_tamy)
#### Post date: [November 7, 2023, 5:59pm UTC](https://discuss.elastic.co/t/extend-the-expiry-of-the-certificates/346548/3 "2023-11-07T17:59:47Z")
I used the cert util command to extend the expiry
elasticsearch-certutil ca --days 1460
When I check the certificate details using the endpoint /\_ssl/certificates
I find one of the certificates which is with alias instance is always for 3 years
Can we extend the expiry for this as well
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [November 7, 2023, 11:09pm UTC](https://discuss.elastic.co/t/extend-the-expiry-of-the-certificates/346548/4 "2023-11-07T23:09:18Z")
> [@smiley\_tamy](#):
>
> I used the cert util command to extend the expiry
> elasticsearch-certutil ca --days 1460
You can't change the expiry for an existing certificate. You can generate a _new_ certificate, but you can't change a certificate.
The `elasticsearch-certutil ca` command generates a new certificate _and_ signing key, so it is, in reality, a totally new CA.
What did you do with the new CA cert/key after you generated it?
---
### Author:  [@smiley\_tamy](https://discuss.elastic.co/u/smiley_tamy)
#### Post date: [November 8, 2023, 1:21pm UTC](https://discuss.elastic.co/t/extend-the-expiry-of-the-certificates/346548/5 "2023-11-08T13:21:08Z")
yeah.. I created new certificates and then noticed that one of them with with alias as instance is created only till 3 years
---
### Author:  [@smiley\_tamy](https://discuss.elastic.co/u/smiley_tamy)
#### Post date: [November 10, 2023, 10:37am UTC](https://discuss.elastic.co/t/extend-the-expiry-of-the-certificates/346548/6 "2023-11-10T10:37:45Z")
I have generated new certificates for 4 years
I can see that from the response of the API
[http://localhost:9200/\_ssl/certificates](http://localhost:9200/_ssl/certificates)
but one of that shows as "subject\_dn": "CN=instance" and is generated only for 3 years
What does this refers to?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 8, 2023, 10:38am UTC](https://discuss.elastic.co/t/extend-the-expiry-of-the-certificates/346548/7 "2023-12-08T10:38:33Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.