# Help with http certs in elasticsearch **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [March 9, 2023, 3:32pm UTC](https://discuss.elastic.co/t/help-with-http-certs-in-elasticsearch/327371 "2023-03-09T15:32:12Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Mary2022](https://avatars.discourse-cdn.com/v4/letter/m/e8c25b/32.png) [@Mary2022](https://discuss.elastic.co/u/Mary2022)\ **Post date:** [March 9, 2023, 3:32pm UTC](https://discuss.elastic.co/t/help-with-http-certs-in-elasticsearch/327371/1 "2023-03-09T15:32:12Z")
I used elasticsearch-certutil with my companies CA.jks to create http certificates for my node but I am at the last step to send the output zip file to the path I give I get the following error: ```auto Exception in thread "main" java.lang.IllegalArgumentException: ca certificate is nota CA! ``` The script I was running: ```auto /usr/share/elasticsearch/bin/elasticsearch-certutil http ``` What format do we need to use ? The CA we were using was .jks We have tried so many things and even tried with our own certificates produced by our company and nothing works. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [March 9, 2023, 4:51pm UTC](https://discuss.elastic.co/t/help-with-http-certs-in-elasticsearch/327371/2 "2023-03-09T16:51:45Z")
Hi @Mary2022 You need your CA to follow this... so .p12 or .pem See [Here](https://www.elastic.co/guide/en/elasticsearch/reference/current/certutil.html#certutil-parameters) > `--ca ` > Specifies the path to an existing CA key pair (in PKCS#12 format). This parameter is only applicable to the `cert` parameter. > `--ca-cert ` > Specifies the path to an existing CA certificate (in PEM format). You must also specify the `--ca-key` parameter. The `--ca-cert` parameter is only applicable to the `cert` parameter. ---
**Author:** ![Mary2022](https://avatars.discourse-cdn.com/v4/letter/m/e8c25b/32.png) [@Mary2022](https://discuss.elastic.co/u/Mary2022)\ **Post date:** [March 9, 2023, 8:23pm UTC](https://discuss.elastic.co/t/help-with-http-certs-in-elasticsearch/327371/3 "2023-03-09T20:23:39Z")
Stephen, Let me go back to when we started trying to generate the certificates for our nodes and before we tried multiple combinations/formats. The CA from my company came in .jks format and when I ran the script below for first time I got an error saying my CA didn't have a key entry. ```auto /usr/share/elasticsearch/bin/elasticsearch-certutil http ``` - Question 1, does it matter if the CA doesn't have a key entry? - Question 2, should we better convert my ca.jks to ca.p12 and then run the script below? ```auto /usr/share/elasticsearch/bin/elasticsearch-certutil --ca /etc/elasticsearch/certs/ca.p12 ``` - Question 3, will this (the script above) prompt me for the information needed to create the certificates for my nodes? - Question 4, is another option to run the script below to create the CSR with the ca.p12 to then create the nodes certificates and key? ```auto /usr/share/elasticsearch/bin/elasticsearch-certutil csr ``` ---
**Author:** ![Mary2022](https://avatars.discourse-cdn.com/v4/letter/m/e8c25b/32.png) [@Mary2022](https://discuss.elastic.co/u/Mary2022)\ **Post date:** [March 10, 2023, 8:40pm UTC](https://discuss.elastic.co/t/help-with-http-certs-in-elasticsearch/327371/4 "2023-03-10T20:40:02Z")
@stephenb ok I took my jks and converted this one to .p12 using keytool. Then I tried using the elasticsearch-certutil in CERT mode with my CA my organization gave me and I got the error "your CA doesnt have a key entry ". Does a CA requires a key entry? ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [March 10, 2023, 8:45pm UTC](https://discuss.elastic.co/t/help-with-http-certs-in-elasticsearch/327371/5 "2023-03-10T20:45:55Z")
Hi @Mary2022 Apologies but I'm not a low level Cert guru.... I have used our tools to create self-signed CAs and Certs And I have generated Certs from the normal public authority type like let's encrypt I'm not sure exactly how to work with your company generated CA. I suspect you may need to ask your cert expert in the company. Nothing Elastic does is unusual with respect to CAs and Certs All that said I do believe .p12 must have a key... Again, you probably need to check with your guru.. how to convert your .jks to a .p12 or a .pem + key ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [March 12, 2023, 1:11pm UTC](https://discuss.elastic.co/t/help-with-http-certs-in-elasticsearch/327371/6 "2023-03-12T13:11:19Z")
Yes, you need to have the key for the CA. It isn't possible to use a CA to issue new certificates unless you have the private key. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 9, 2023, 1:11pm UTC](https://discuss.elastic.co/t/help-with-http-certs-in-elasticsearch/327371/7 "2023-04-09T13:11:28Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.