# How do I extend the SSL Certificate expiry period?s
**URL:** https://discuss.elastic.co/t/how-do-i-extend-the-ssl-certificate-expiry-period-s/318922
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [November 15, 2022, 6:43am UTC](https://discuss.elastic.co/t/how-do-i-extend-the-ssl-certificate-expiry-period-s/318922 "2022-11-15T06:43:43Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@RusseL](https://discuss.elastic.co/u/RusseL)
#### Post date: [November 15, 2022, 6:43am UTC](https://discuss.elastic.co/t/how-do-i-extend-the-ssl-certificate-expiry-period-s/318922/1 "2022-11-15T06:43:43Z")
Hi everyone.
I have an ES Cluster(ES version 7.4.2) that has been running for 3 years.
when I run the following query.
`GET _ssl/certificates`
I'm getting the output.
`"expiry" : "2022-11-20T07:27:29.000Z"`
My cluster is in active use and shutting it down will be a problem for me. Is there a way to extend the certificate period? Or any suggestions.
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [November 15, 2022, 7:12am UTC](https://discuss.elastic.co/t/how-do-i-extend-the-ssl-certificate-expiry-period-s/318922/2 "2022-11-15T07:12:16Z")
7.4 is [EOL](https://www.elastic.co/support/eol) and no longer supported, please upgrade 🙂
You will need to replace the certificates with updated ones that have longer expirations. You should be able to do that with a rolling restart however.
---
### Author:  [@RusseL](https://discuss.elastic.co/u/RusseL)
#### Post date: [November 16, 2022, 7:28am UTC](https://discuss.elastic.co/t/how-do-i-extend-the-ssl-certificate-expiry-period-s/318922/3 "2022-11-16T07:28:08Z")
Hi @warkolm. Thanks for answer.
in `/usr/share/elasticsearch`
For the new '`temescls01-ca.p12`' certificate
I run '`./bin/elasticsearch-certutil cert --ca /etc/elasticsearch/certs/temescls01-ca.p12`' and when I enter the 'CA CERT password' it generates a new temescl01-ca.p12 certificate.
For the new '`temescls01-certificates.p12`' certificate
I run `'./bin/elasticsearch-certutil cert /etc/elasticsearch/certs/temescls01-certificates.p12`' and enter the 'keystore password'.
I'm using the old certificates' passwords for both new certificates.
I was able to create all 2 certificates. But when I stop the elasticsearch service and replace the old certificates with new certificates [by following the document here](https://www.elastic.co/guide/en/elasticsearch/reference/current/update-node-certs-same.html), the node cannot join the cluster. When I replace the old certificate, the node joins the cluster without any problems.
An example from elasticsearch.yml
elasticsearch.yml
```auto
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: certs/temescls01-certificates.p12
xpack.security.transport.ssl.keystore.password: XXXXXXXXX
xpack.security.transport.ssl.truestore.path: certs/temescls01-certificates.p12
xpack.security.transport.ssl.truestore.password: XXXXXXXXX
```
Is there something i did wrong?
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [November 16, 2022, 9:30pm UTC](https://discuss.elastic.co/t/how-do-i-extend-the-ssl-certificate-expiry-period-s/318922/4 "2022-11-16T21:30:33Z")
You will need to share logs please.
---
### Author:  [@RusseL](https://discuss.elastic.co/u/RusseL)
#### Post date: [November 17, 2022, 7:05am UTC](https://discuss.elastic.co/t/how-do-i-extend-the-ssl-certificate-expiry-period-s/318922/5 "2022-11-17T07:05:43Z")
Hi @warkolm.
I solved the problem by following the steps in [this article](https://medium.com/@musabdogan/how-to-extend-elasticsearch-ssl-certificate-expiry-date-99820ff87615). In addition, I had to restart the service on a single node. I think it's because my ES version is 7.4.2.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 15, 2022, 7:06am UTC](https://discuss.elastic.co/t/how-do-i-extend-the-ssl-certificate-expiry-period-s/318922/6 "2022-12-15T07:06:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.