# Rotate X-Pack Certificate

**URL:** <https://discuss.elastic.co/t/rotate-x-pack-certificate/152713>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [October 16, 2018, 7:45pm UTC](https://discuss.elastic.co/t/rotate-x-pack-certificate/152713 "2018-10-16T19:45:51Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![sschins](https://avatars.discourse-cdn.com/v4/letter/s/43a26b/32.png) [@sschins](https://discuss.elastic.co/u/sschins)\
**Post date:** [October 16, 2018, 7:45pm UTC](https://discuss.elastic.co/t/rotate-x-pack-certificate/152713/1 "2018-10-16T19:45:51Z")

</div>

I wrote a script to rotate X-Pack certificates but can't get Elasticsearch to start. How should certificates get rotated?

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [October 17, 2018, 4:39am UTC](https://discuss.elastic.co/t/rotate-x-pack-certificate/152713/2 "2018-10-17T04:39:07Z")

</div>

> How should certificates get rotated?

It depends.

You can rotate certificates in place. Elasticsearch will detect changes to those files and reload them, but you will need to take care to update the key and certificate at the same time.

If the certificates are for the transport connection, then this will only work if they have the same trust-chain (CAs) are before (or, more accurately, if both the previous signing chain and the new signing chain are both trusted by all of the cluster nodes).

Alternatively, if you want to point to new certificate files, you may need to do rolling restarts. Depending on which certs you want to update you may potentially need to do multiple rounds of restarts to update CAs, then certs, then CAs.

> [@sschins](#):
>
> can't get Elasticsearch to start

We're much better at solving problems if you actually describe the error to us. What exactly is preventing ES from starting?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 14, 2018, 4:39am UTC](https://discuss.elastic.co/t/rotate-x-pack-certificate/152713/3 "2018-11-14T04:39:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.