# External Certificate configuration **URL:** \ **Category:** Elasticsearch\ **Created:** [September 20, 2024, 8:07pm UTC](https://discuss.elastic.co/t/external-certificate-configuration/366891 "2024-09-20T20:07:20Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Santanu112](https://avatars.discourse-cdn.com/v4/letter/s/3bc359/32.png) [@Santanu112](https://discuss.elastic.co/u/Santanu112)\ **Post date:** [September 20, 2024, 8:07pm UTC](https://discuss.elastic.co/t/external-certificate-configuration/366891/1 "2024-09-20T20:07:20Z")
Hi Team, I am trying to add my org certificate (.pfx) to elastic security so we can securely access it from other servers. i am not able to import it in existing CA cert. Could any one please tell me how to add it in existing (Basic security) configuration ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [September 23, 2024, 12:59am UTC](https://discuss.elastic.co/t/external-certificate-configuration/366891/2 "2024-09-23T00:59:07Z")
Please provide more details about your current configuration, the structure of your org certificate and what exactly you're trying to change. ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [September 23, 2024, 5:05am UTC](https://discuss.elastic.co/t/external-certificate-configuration/366891/3 "2024-09-23T05:05:38Z")
The pfx format contains the public and the private key. You should use openssl to export. `openssl pkcs12 -in [yourfile.pfx] -nocerts -out [private.key]` `openssl pkcs12 -in [yourfile.pfx] -clcerts -nokeys -out [public.crt]` `openssl rsa -in [private.key] -out [private-decrypted.key]` ---
**Author:** ![Santanu112](https://avatars.discourse-cdn.com/v4/letter/s/3bc359/32.png) [@Santanu112](https://discuss.elastic.co/u/Santanu112)\ **Post date:** [September 23, 2024, 2:39pm UTC](https://discuss.elastic.co/t/external-certificate-configuration/366891/4 "2024-09-23T14:39:17Z")
xpack.security.transport.ssl.enabled: true xpack.security.transport.ssl.verification\_mode: certificate xpack.security.transport.ssl.client\_authentication: required xpack.security.transport.ssl.keystore.path: elastic-certificates.p12 xpack.security.transport.ssl.truststore.path: elastic-certificates.p12 xpack.security.transport.ssl.truststore.secure\_password: "_**" xpack.security.transport.ssl.keystore.secure\_password: "**_" xpack.security.http.ssl.enabled: true xpack.security.http.ssl.keystore.secure\_password : "\*\*\*" xpack.security.http.ssl.keystore.path: "http.p12 this is my current configuration ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [September 24, 2024, 12:34am UTC](https://discuss.elastic.co/t/external-certificate-configuration/366891/5 "2024-09-24T00:34:56Z")
I asked for multiple pieces of information. I cannot help without that information. ---
**Author:** ![Santanu112](https://avatars.discourse-cdn.com/v4/letter/s/3bc359/32.png) [@Santanu112](https://discuss.elastic.co/u/Santanu112)\ **Post date:** [September 24, 2024, 2:07pm UTC](https://discuss.elastic.co/t/external-certificate-configuration/366891/6 "2024-09-24T14:07:14Z")
The org certificate contains root and issuer.. Its a pfx certificate.. I am trying to import this org cert into my elk so other application from other server of my org can use and connect elk ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [September 24, 2024, 5:07pm UTC](https://discuss.elastic.co/t/external-certificate-configuration/366891/7 "2024-09-24T17:07:31Z")
You cannot import as pfx AFAIK. You should use two separated keys.