# Renew http.p12 and http\_ca.p12 **URL:** \ **Category:** Elasticsearch\ **Created:** [August 13, 2025, 3:09am UTC](https://discuss.elastic.co/t/renew-http-p12-and-http-ca-p12/380983 "2025-08-13T03:09:43Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Frances\_Chu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/frances_chu/32/127298_2.png) [@Frances\_Chu](https://discuss.elastic.co/u/Frances_Chu)\ **Post date:** [August 13, 2025, 3:09am UTC](https://discuss.elastic.co/t/renew-http-p12-and-http-ca-p12/380983/1 "2025-08-13T03:09:43Z")
In my system **http.p12** expired in **2025** **http\_ca.p12** expired in **2026** I renew the **http.p12 to 2030** using the http\_ca.p12. May I know whehter http.p12 can work in 2027 (as http\_ca.p12 expired in 2026) If not. Is there any means to renew the http\_ca.p12 ---
**Author:** ![Shaoranlaos](https://avatars.discourse-cdn.com/v4/letter/s/c57346/32.png) [@Shaoranlaos](https://discuss.elastic.co/u/Shaoranlaos)\ **Post date:** [August 13, 2025, 8:26am UTC](https://discuss.elastic.co/t/renew-http-p12-and-http-ca-p12/380983/2 "2025-08-13T08:26:18Z")
Hello, the http certs are only valid as long as the CA is valid. So unfortunately you will have to generate a new CA and also new HTTP Certs for every node. I had the same problem one our cluster. The following is described in the documentation: [Different CA | Elastic Docs](https://www.elastic.co/docs/deploy-manage/security/different-ca#node-certs-different-http) You have to generate a new CA store/certificate with the elasticsearch-certutil command: ```auto ./bin/elasticsearch-certutil ca ``` This outputs a p12 store which you can then use to create new certificates for the nodes (like you have already done). Attention: this is for some client not possible without downtime (clients where you can only define one CA to verify against, like with the fingerprint option in the Beats or Logstash).