# Issues Getting Node to Rejoin Cluster after Renewing Certificates
**URL:** https://discuss.elastic.co/t/issues-getting-node-to-rejoin-cluster-after-renewing-certificates/383296
**Category:** Elastic Agent
**Created:** [November 7, 2025, 4:33pm UTC](https://discuss.elastic.co/t/issues-getting-node-to-rejoin-cluster-after-renewing-certificates/383296 "2025-11-07T16:33:55Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@sourcreamnormanbates](https://discuss.elastic.co/u/sourcreamnormanbates)
#### Post date: [November 7, 2025, 4:33pm UTC](https://discuss.elastic.co/t/issues-getting-node-to-rejoin-cluster-after-renewing-certificates/383296/1 "2025-11-07T16:33:55Z")
I’ve been working through the challenges of renewing my http and transport certificates on one of my nodes. Both were renewed using the same CA that was used prior.
Although the elasticsearch service is now starting successfully, I’m still having issues.
My node isn’t rejoining the cluster.
Based on these instructions, I’m wondering if I need to generate new certificates for all of my nodes and reboot all of them? I was hoping that by using the same CA that the new certificates would be trusted.
[Update certificates with the same CA | Elasticsearch Guide [8.19] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/8.19/update-node-certs-same.html)
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [November 7, 2025, 5:22pm UTC](https://discuss.elastic.co/t/issues-getting-node-to-rejoin-cluster-after-renewing-certificates/383296/2 "2025-11-07T17:22:39Z")
> [@sourcreamnormanbates](#):
>
> I’ve been working through the challenges of renewing my http and transport certificates on one of my nodes. Both were renewed using the same CA that was used prior.
Only the certificate of this node expired?
> [@sourcreamnormanbates](#):
>
> My node isn’t rejoining the cluster.
Please share the logs you are receiving, it will have the reason why it cannot join the cluster.
---
### Author:  [@sourcreamnormanbates](https://discuss.elastic.co/u/sourcreamnormanbates)
#### Post date: [November 7, 2025, 6:26pm UTC](https://discuss.elastic.co/t/issues-getting-node-to-rejoin-cluster-after-renewing-certificates/383296/3 "2025-11-07T18:26:28Z")
Actually, certificates expired on Node01 (192.168.XX.20) and Node02 (192.168.XX.21). Node03 and Node04 were added later, so those certs are still valid.
I haven’t made any changes to certs on any other node.
][o.e.d.PeerFinder][node01] address [192.168.XX.21:9300], node [unknown] discovery result: [192.168.XX.21:9300] connect\_exception: (certificate\_unknown) PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target: unable to find valid certification path to requested target; for summary, see logs from org.elasticsearch.cluster.coordination.ClusterFormationFailureHelper; for troubleshooting guidance, see [https://www.elastic.co/docs/troubleshoot/elasticsearch/discovery-troubleshooting?version=9.1(external, opens in a new tab or window)](https://www.elastic.co/docs/troubleshoot/elasticsearch/discovery-troubleshooting?version=9.1)
[2025-11-07T13:50:46,759][WARN][o.e.t.TcpTransport][node01] exception caught on transport layer [Netty4TcpChannel{localAddress=/192.168.XX.20:52876, remoteAddress=/192.168.XX.21:9300,
profile=default}], closing connection
io.netty.handler.codec.DecoderException: javax.net.ssl.SSLHandshakeException: (certificate\_unknown) PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [November 8, 2025, 9:49am UTC](https://discuss.elastic.co/t/issues-getting-node-to-rejoin-cluster-after-renewing-certificates/383296/4 "2025-11-08T09:49:26Z")
> [@sourcreamnormanbates](#):
>
> PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target: unable to find valid certification path to requested target; for summary, see logs from
Something is not OK with path to certs or permissions.
---
### Author:  [@sourcreamnormanbates](https://discuss.elastic.co/u/sourcreamnormanbates)
#### Post date: [November 11, 2025, 2:58pm UTC](https://discuss.elastic.co/t/issues-getting-node-to-rejoin-cluster-after-renewing-certificates/383296/5 "2025-11-11T14:58:16Z")
This was resolved by generating new transport certificates for all nodes.
1. On one node, generate new keys for all nodes, using elasticsearch-certutil cert -ca –multiple
2. Distribute transport.p12 to each node.
3. Update keystore with elasticsearch-keystore add “xpackPathtoKey”
4. Update elasticsearch.yml with current path to transport.p12 (if is different now)
5. Restart elasticsearch.
6. Verify node joins cluster by reviewing /var/log/elasticsearch/YourClusterName.log.