# In what folder is the private key that corresponds to the certificate config\\certs\\http\_ca.crt?

**URL:** <https://discuss.elastic.co/t/in-what-folder-is-the-private-key-that-corresponds-to-the-certificate-config-certs-http-ca-crt/308488>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [June 29, 2022, 3:12pm UTC](https://discuss.elastic.co/t/in-what-folder-is-the-private-key-that-corresponds-to-the-certificate-config-certs-http-ca-crt/308488 "2022-06-29T15:12:19Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![DataStorageMuse](https://avatars.discourse-cdn.com/v4/letter/d/bcef8e/32.png) [@DataStorageMuse](https://discuss.elastic.co/u/DataStorageMuse)\
**Post date:** [June 29, 2022, 3:12pm UTC](https://discuss.elastic.co/t/in-what-folder-is-the-private-key-that-corresponds-to-the-certificate-config-certs-http-ca-crt/308488/1 "2022-06-29T15:12:19Z")

</div>

I'm trying to modify http\_ca.crt (using the command ./bin/elasticsearch-certutil http), and it asks me for the path to private key corresponding to that file:

```auto
 What is the path to your CA key?
elasticsearch-8.2.3-windows-x86_64\elasticsearch-8.2.3\config\certs\http_ca.crt appears to be a PEM formatted certificate file.
In order to use it for signing we also need access to the private key

```

Where is the location of the CA key?

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [June 29, 2022, 10:08pm UTC](https://discuss.elastic.co/t/in-what-folder-is-the-private-key-that-corresponds-to-the-certificate-config-certs-http-ca-crt/308488/2 "2022-06-29T22:08:40Z")

</div>

Hi @DataStorageMuse its me again 🙂

It is stored in the elasticsearch encrypted key store... You will not be able to access it... You will not be able to modify the cert you will need to create a completely new one as far as I know. Hence a private key.

BTW I only figured this out last night when I was working on your other question...

You can see that it is in there with

```auto
hyperion:elasticsearch-8.2.3 sbrown$ ./bin/elasticsearch-keystore list
warning: ignoring JAVA_HOME=/Library/Java/JavaVirtualMachines/jdk-11.0.13.jdk/Contents/Home; using bundled JDK
keystore.seed
xpack.security.http.ssl.keystore.secure_password
xpack.security.transport.ssl.keystore.secure_password
xpack.security.transport.ssl.truststore.secure_password

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 27, 2022, 10:09pm UTC](https://discuss.elastic.co/t/in-what-folder-is-the-private-key-that-corresponds-to-the-certificate-config-certs-http-ca-crt/308488/3 "2022-07-27T22:09:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.