# Generation new ssl keys for a new node **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [November 16, 2021, 11:10am UTC](https://discuss.elastic.co/t/generation-new-ssl-keys-for-a-new-node/289312 "2021-11-16T11:10:03Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![hinoryo](https://avatars.discourse-cdn.com/v4/letter/h/8c91f0/32.png) [@hinoryo](https://discuss.elastic.co/u/hinoryo)\ **Post date:** [November 16, 2021, 11:10am UTC](https://discuss.elastic.co/t/generation-new-ssl-keys-for-a-new-node/289312/1 "2021-11-16T11:10:03Z")
hello , i have a cluster of 3 nodes and i want to add a new node to the cluster, for that i need to regenerate a new certificate for this new node; i generate the first certs using this command: ```auto /usr/share/elasticsearch/bin/elasticsearch-certutil cert --keep-ca-key ca --pem --in /etc/elasticsearch/instance.yml --out /etc/elasticsearch/certss.zip ``` and i try to regenerate the new certs for es4 node using this command: ```auto /usr/share/elasticsearch/bin/elasticsearch-certutil cert --pem --ca-cert /etc/elasticsearch/ca/ca.crt --ca-key /etc/elasticsearch/ca/ca.key --in /etc/elasticsearch/instance.new.node.yml --out /etc/elasticsearch/es4.new.zip ``` but when starting the new node i got this warn: [es4] client did not trust this server's certificate, closing connection Netty4TcpChannel{localAddress. ---
**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\ **Post date:** [November 16, 2021, 11:51pm UTC](https://discuss.elastic.co/t/generation-new-ssl-keys-for-a-new-node/289312/2 "2021-11-16T23:51:39Z")
The first command has some odditiy in that it has a `ca` parameter after `--keep-ca-key`. It is not necessary but does not seem to cause any issue. The problem is most likely related to the configurations around TLS, e.g. either the CA is not configured consistently or the ca file used to generate the cert is not the one used for the old nodes. It would be helpful if you could share the followings for further diagnosis: 1. Relevant sections in the Elasticsearch.yml file of the old nodes and new node. 2. Complete log messages around the exception. ---
**Author:** ![hinoryo](https://avatars.discourse-cdn.com/v4/letter/h/8c91f0/32.png) [@hinoryo](https://discuss.elastic.co/u/hinoryo)\ **Post date:** [November 17, 2021, 3:03pm UTC](https://discuss.elastic.co/t/generation-new-ssl-keys-for-a-new-node/289312/3 "2021-11-17T15:03:41Z")
hello , thx for your reply this help me a lot to resolve the issue. the problem is that i was referring to an old ca.crt/ca.key. ---
**Author:** ![hinoryo](https://avatars.discourse-cdn.com/v4/letter/h/8c91f0/32.png) [@hinoryo](https://discuss.elastic.co/u/hinoryo)\ **Post date:** [November 17, 2021, 3:51pm UTC](https://discuss.elastic.co/t/generation-new-ssl-keys-for-a-new-node/289312/4 "2021-11-17T15:51:06Z")
one more question if you don't mind, if i have the ca.crt file and lost the ca.key can i regenerate the certs for the new node ? thanks, ---
**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\ **Post date:** [November 18, 2021, 11:27pm UTC](https://discuss.elastic.co/t/generation-new-ssl-keys-for-a-new-node/289312/5 "2021-11-18T23:27:21Z")
No you need the key to generate any new certs. You can however reuse certs of existing nodes for the new node if the `verification_mode` is configured to be `certificate`. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 29, 2021, 8:32am UTC](https://discuss.elastic.co/t/generation-new-ssl-keys-for-a-new-node/289312/7 "2021-12-29T08:32:58Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.