# How to use pfx file with certutil **URL:** \ **Category:** Elasticsearch\ **Created:** [February 1, 2018, 12:46pm UTC](https://discuss.elastic.co/t/how-to-use-pfx-file-with-certutil/118023 "2018-02-01T12:46:12Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![stephenpatten](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenpatten/32/9146_2.png) [@stephenpatten](https://discuss.elastic.co/u/stephenpatten)\ **Post date:** [February 1, 2018, 12:46pm UTC](https://discuss.elastic.co/t/how-to-use-pfx-file-with-certutil/118023/1 "2018-02-01T12:46:12Z")
Hello, I have a pfx file from my IT dept to use in one of our environments, can I use that, or convert it to a format suitable for use with certutil? Total noob question, sorry Thank you, Stephen ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [February 1, 2018, 11:50pm UTC](https://discuss.elastic.co/t/how-to-use-pfx-file-with-certutil/118023/2 "2018-02-01T23:50:37Z")
A pfx file is Microsoft's name for a PKCS#12 file (the history is a little more complicated than that, but you can read it on Wikipedia if you care) X-Pack supports PCKS#12 as of Elasticsearch v6.0 by treating them as a `keystore` (or `truststore`) [https://www.elastic.co/guide/en/elasticsearch/reference/6.0/security-settings.html#\_pkcs\_12\_files\_3](https://www.elastic.co/guide/en/elasticsearch/reference/6.0/security-settings.html#_pkcs_12_files_3) ---
**Author:** ![stephenpatten](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenpatten/32/9146_2.png) [@stephenpatten](https://discuss.elastic.co/u/stephenpatten)\ **Post date:** [February 2, 2018, 3:17am UTC](https://discuss.elastic.co/t/how-to-use-pfx-file-with-certutil/118023/3 "2018-02-02T03:17:36Z")
Hey Tim, Thanks again for jumping in. If I went that route, what would change in this documentation then? This [blog post](https://www.elastic.co/blog/tls-elastic-stack-elasticsearch-kibana-logstash-filebeat) is becoming the basis for my deployment run-book, would you be able to tell me where the setup would differ? Sounds like I can use these files end to end too , correct? ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [February 6, 2018, 4:40am UTC](https://discuss.elastic.co/t/how-to-use-pfx-file-with-certutil/118023/4 "2018-02-06T04:40:25Z")
Sorry for the delay in getting back to you. If you want to convert PKCS#12 file to PEM format, you can, but you need to use `openssl`. `certutil` doesn't have any file conversion functions. For which purposes do you intend to use the certificate that your IT dept provided? - internal cluster traffic (transport interface) ? - API traffic (http interface) ? - Kibana ? - Logstash ? - Beats ? For anything within Elasticsearch you can just switch in `ssl.keystore.path` everywhere the blog post suggests using `ssl.certificate` and `ssl.key`. Depending on what's in the `.pfx` file, you may also want to set `ssl.truststore.path` instead of `ssl.certificate_authorities`, but I can't be sure without knowing what your PKCS#12 file contains. So: ```auto xpack.ssl.key: certs/node1.key xpack.ssl.certificate: certs/node1.crt xpack.ssl.certificate_authorities: certs/ca.crt ``` could become ```auto xpack.ssl.keystore.path: certs/elasticsearch.pfx xpack.ssl.certificate_authorities: certs/corporate-ca.crt ``` or ```auto xpack.ssl.keystore.path: certs/elasticsearch.pfx xpack.ssl.truststore.path: certs/elasticsearch.pfx ``` or even ```auto xpack.ssl.keystore.path: certs/elasticsearch.pfx xpack.ssl.truststore.path: certs/corporate-ca.pfx ``` It just depends. Sorry I can't be more helpful. Setting up TLS can be _not-too-painful_ if you get to control the whole process, but once corporate CAs get involved, it introduces a lot of variables, and it's hard to define a precise process. I would start by looking at the contents of the pfx file. If you have access to openssl, then you can do: ```auto openssl pkcs12 -in elasticsearch.pfx -nodes ``` If not, then java's `keytool` can do an adequate (but not great) job: ```auto keytool -list -keystore elasticsearch.pfx ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 6, 2018, 4:40am UTC](https://discuss.elastic.co/t/how-to-use-pfx-file-with-certutil/118023/5 "2018-03-06T04:40:59Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.