Renew http_ca.crt CA certificate of the elasticsearch cluster

Hello,

Can anyone help me understand on how to renew the http CA certificate for an autoconfigured on-prem cluster? This certificate was being used in the logstash's elasticsearch output section's cacert setting, however the system broke once the certificate expired. What is a safe way to renew this certificate and once renewed will I have to update anything in the http keystore? Also since its a production setup I don't want to mess up anything, are there any gotacha I should be aware off. For now I am using the ssl_certificate_verification => false as a workaround.

Hello, the procedure is documented in Update security certificates with a different CA | Elasticsearch Guide [8.17] | Elastic. Note that this also documents the case where you want to use an existing CA. This is not your case, so you should not skip the step that generates a new CA.