Hello! We have been using Elasticsearch with Zammad on an Ubuntu server for several months, and we recently moved the server to a new IP address. Because Elasticsearch was set up with the former IP address, the auto-generated SSL Certificate, "/etc/elasticsearch/certs/http_ca.crt", is not working with the new IP address. Specifically, it gives an error that the IP address does not match the one in the certificate. We were wondering if there was a command to use that would regenerate this SSL Certificate based on the current IP settings? I tried using the bin/elasticsearch-certutil command but when I do that it says that there is "no such file or directory". I am unable to use that command, and based on my reading of the webpage: [image] elasticsearch-certutil | Elastic Documentation The elasticsearch-certutil command simplifies the creation of certificates for use with Transport Layer Security (TLS) in the Elastic Stack. You can specify... I do not know if that would solve our issue as we are not trying to create a new Certificate Authority or a whole new set of certificates and keys, just the one that was generated on setup. Please let me know if there is any more information that you would need to get a better idea of our situation, and thank you in advance for your help.

Hi @frdh-samuelw Seems a lot like this post [image] Are the Self Signed Certs bound by IP / Hostname Elastic Security Hi, We have a cluster in which we have enabled TLS security. To enable the security we used the elastic cert utility to generate the cert and CA. While generation of the certs or the CA any of the prompts did not ask us about the Hostnames or IP. We generated just one certificate and used that cert in all the nodes. Now the machines are moving to new IP and we are confused if the previous cert which is working now will work or not. Are the certs generated with elasticsearch cert-util are bound … What version are you on? [image] frdh-samuelw: bin/elasticsearch-certutil command but when I do that it says that there is "no such file or directory". I am unable to use that command, and based on my reading of the webpage: Where are you running that from? / How did you install? But yes you need to regenerate the Certs and then make sure if you created [image] elasticsearch-certutil | Elastic Documentation The elasticsearch-certutil command simplifies the creation of certificates for use with Transport Layer Security (TLS) in the Elastic Stack. You can specify...

Hello @stephenb ! Thank you for your response! We are using elasticsearch version 8.17.1 Thank you for linking that post. The situation is very similar, however we have not used the cert utility at all yet, we have only used the auto-generated SSL certificate. I tried using the bin/elasticsearch-certutil from the home directory. Sorry, I haven't used commands with 'bin' at the beginning before, should I run that from the /etc/elasticsearch directory? We installed by following the instructions here: [image] Install Elasticsearch with a Debian package | Elastic documentation The Debian package for Elasticsearch can be downloaded from our website or from our APT repository. It can be used to install Elasticsearch on any Debian-based... Using the apt repository. I did not set up additional nodes as we only have the one server running Elastic Search. For the certutil command page, would the certificate I want to regenerate be an "HTTP" certificate? There doesn't seem to be anything there about the default http_ca.crt or how to get it to regenerate, but if creating a new one is the way to go then I would definitely try that if I can get the command to work. Thank you again for your help!

If you installed as a Deb package you need to go to cd /usr/share/elasticsearch The Home directory as detailed at the bottom of the page you linked and run commands from there

This happens because the original certificate includes the old IP or hostname. Here's how to regenerate it correctly: Go to the Elasticsearch installation path cd /usr/share/elasticsearch Run certutil in interactive mode sudo bin/elasticsearch-certutil http Follow the prompts: Generate a new certificate Enter the new server IP or hostname Save the .zip file Extract the new certs unzip elasticsearch-ssl-http.zip -d certs/ 5. **Replace the old certs** sudo mv /etc/elasticsearch/certs /etc/elasticsearch/certs.bak sudo mv certs/ /etc/elasticsearch/certs Update elasticsearch.yml if needed yaml xpack.security.http.ssl: enabled: true key: /etc/elasticsearch/certs/elasticsearch.key certificate: /etc/elasticsearch/certs/elasticsearch.crt certificate_authorities: [ "/etc/elasticsearch/certs/ca.crt" ] Restart Elasticsearch sudo systemctl restart elasticsearch --- Hope this helps anyone facing the same issue! If you're using Docker or Elastic Cloud, the steps are slightly different — happy to help if needed. — *Contributed by [Rafael Silva](https://www.linkedin.com/in/rafael-silva-observabilidade/), Observability Specialist & Elastic Enthusiast* [GitHub: @rafasilva1984](https://github.com/rafasilva1984

I’m facing the same issue. I had a 3 node cluster and the IP address of all nodes has been changed. What are the exact steps to generate certificates with new SANs which should include the new IP address of server?

Hi @Yaser_Amini Welcome to the community 1st place to start is the official documentation [image] Update TLS certificates | Elastic Docs You might need to update your TLS certificates if your current node certificates expire soon, you’re adding new nodes to your secured cluster, or a security... And here are details on using the cert util [image] elasticsearch-certutil | Reference The elasticsearch-certutil command simplifies the creation of certificates for use with Transport Layer Security (TLS) in the Elastic Stack. You can specify... I like using the Silent Mode with instances.yml to create new certs with the correct SANs / IPs etc [image] elasticsearch-certutil | Reference The elasticsearch-certutil command simplifies the creation of certificates for use with Transport Layer Security (TLS) in the Elastic Stack. You can specify...

Regenerate the SSL Certificate that was auto-generated on setup of ElasticSearch

Elastic Search

stephenb (Stephen Brown) November 27, 2025, 4:32pm 7

Hi @Yaser_Amini Welcome to the community

1st place to start is the official documentation

And here are details on using the cert util

I like using the Silent Mode with instances.yml to create new certs with the correct SANs / IPs etc

Reindex from remote source doesn't work with either API key or user/PW?

Topic		Replies	Views
Recreate the automatically generated certificates Elasticsearch	2	4005	January 12, 2024
Are the Self Signed Certs bound by IP / Hostname Elastic Security	11	241	April 21, 2025
How to re-generate certificate for nodes elasticsearch to enable xpack Elasticsearch elastic-stack-security	2	494	January 29, 2021
Generation new ssl keys for a new node Elasticsearch elastic-stack-security	4	616	November 18, 2021
How to replace Security Certificate sign by Elastic CA Elasticsearch elastic-stack-security	4	2998	April 22, 2022

Regenerate the SSL Certificate that was auto-generated on setup of ElasticSearch

Related topics