# Renew http\_ca.crt CA certificate of the elasticsearch cluster
**URL:** https://discuss.elastic.co/t/renew-http-ca-crt-ca-certificate-of-the-elasticsearch-cluster/374526
**Category:** Elasticsearch
**Created:** [February 13, 2025, 6:41pm UTC](https://discuss.elastic.co/t/renew-http-ca-crt-ca-certificate-of-the-elasticsearch-cluster/374526 "2025-02-13T18:41:39Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@Ankita\_Pachauri](https://discuss.elastic.co/u/Ankita_Pachauri)
#### Post date: [February 13, 2025, 6:41pm UTC](https://discuss.elastic.co/t/renew-http-ca-crt-ca-certificate-of-the-elasticsearch-cluster/374526/1 "2025-02-13T18:41:39Z")
Hello,
Can anyone help me understand on how to renew the http CA certificate for an autoconfigured on-prem cluster? This certificate was being used in the logstash's elasticsearch output section's cacert setting, however the system broke once the certificate expired. What is a safe way to renew this certificate and once renewed will I have to update anything in the http keystore? Also since its a production setup I don't want to mess up anything, are there any gotacha I should be aware off. For now I am using the ssl\_certificate\_verification =\> false as a workaround.
---
### Author:  [@Quentin\_Pradet](https://discuss.elastic.co/u/Quentin_Pradet)
#### Post date: [February 14, 2025, 11:30am UTC](https://discuss.elastic.co/t/renew-http-ca-crt-ca-certificate-of-the-elasticsearch-cluster/374526/2 "2025-02-14T11:30:41Z")
Hello, the procedure is documented in [Update security certificates with a different CA | Elasticsearch Guide [8.17] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/update-node-certs-different.html). Note that this also documents the case where you want to use an existing CA. This is not your case, so you should not skip the step that generates a new CA.