# Is it possible to setup 3 node elastic cluster without ca password

**URL:** <https://discuss.elastic.co/t/is-it-possible-to-setup-3-node-elastic-cluster-without-ca-password/379017>\
**Category:** Elasticsearch\
**Created:** [June 9, 2025, 6:02pm UTC](https://discuss.elastic.co/t/is-it-possible-to-setup-3-node-elastic-cluster-without-ca-password/379017 "2025-06-09T18:02:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![IamGuna](https://avatars.discourse-cdn.com/v4/letter/i/41988e/32.png) [@IamGuna](https://discuss.elastic.co/u/IamGuna)\
**Post date:** [June 9, 2025, 6:02pm UTC](https://discuss.elastic.co/t/is-it-possible-to-setup-3-node-elastic-cluster-without-ca-password/379017/1 "2025-06-09T18:02:58Z")

</div>

I was able to setup 3 node elastic cluster via elastic CA method - based on [Setting up 3 node cluster for first time and getting errors - #2 by leandrojmp](https://discuss.elastic.co/t/setting-up-3-node-cluster-for-first-time-and-getting-errors/378775/2)  
Now, the requirement is to use certs provided by org, certified by org's CA. The problem I have is - I will get the root ca cert, but not the key and password. Since it is used to certify all other apps, cannot be shared with anyone.  
How can I setup a cluster in this case?  
Any help is greatly appreciated!!

---

<div class="post-metadata">

**Author:** ![dot-mike](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dot-mike/32/143339_2.png) [@dot-mike](https://discuss.elastic.co/u/dot-mike)\
**Post date:** [June 9, 2025, 6:23pm UTC](https://discuss.elastic.co/t/is-it-possible-to-setup-3-node-elastic-cluster-without-ca-password/379017/2 "2025-06-09T18:23:09Z")

</div>

Two ways:  
Either generate a SUB CA that the Elastic CA can use to generate new certs for the  
nodes OR you ask the CA owner to generate certs for all your nodes.

I suggest you read up on PKI hierarchy and it's fundamentals.

---

<div class="post-metadata">

**Author:** ![IamGuna](https://avatars.discourse-cdn.com/v4/letter/i/41988e/32.png) [@IamGuna](https://discuss.elastic.co/u/IamGuna)\
**Post date:** [June 11, 2025, 9:20am UTC](https://discuss.elastic.co/t/is-it-possible-to-setup-3-node-elastic-cluster-without-ca-password/379017/3 "2025-06-11T09:20:58Z")

</div>

Thank you for your guidance @dot-mike .  
In fact, the CA owner (the PKI team) has generated the certs for us. Since the CA cert key & password cannot be shared, I am now checking for the sub-CA option.