# Running elastic search cluster with expired TLS ceritificate
**URL:** https://discuss.elastic.co/t/running-elastic-search-cluster-with-expired-tls-ceritificate/375996
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [March 17, 2025, 10:28am UTC](https://discuss.elastic.co/t/running-elastic-search-cluster-with-expired-tls-ceritificate/375996 "2025-03-17T10:28:08Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@piyushgupta](https://discuss.elastic.co/u/piyushgupta)
#### Post date: [March 17, 2025, 10:28am UTC](https://discuss.elastic.co/t/running-elastic-search-cluster-with-expired-tls-ceritificate/375996/1 "2025-03-17T10:28:08Z")
Hi ,
we are running 6 node cluster with 3 master and 3 data node
in each node we are using letsencrypt certificate as below which expires every 3 month
xpack.security.http.ssl.enabled: true
xpack.security.http.ssl.key: /etc/elasticsearch/certs/letsencrypt/elk.key
xpack.security.http.ssl.certificate: /etc/elasticsearch/certs/letsencrypt/elk.crt
xpack.security.http.ssl.certificate\_authorities: ["/etc/elasticsearch/certs/letsencrypt/isrgrootx1.pem"]
from clients like fluent bit that connect with Elasticsearch cluster we disabled the certificate validation and it worked well
From Elasticsearch cluster operation point of view , can we keep the cluster up and running with expired certificate ?
Any risk keeping the expired certificates , considering its a production cluster , on the typical operations of the cluster
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [March 17, 2025, 1:31pm UTC](https://discuss.elastic.co/t/running-elastic-search-cluster-with-expired-tls-ceritificate/375996/2 "2025-03-17T13:31:54Z")
The communication between nodes use the `xpack.security.transport.*` settings, are you generating these certificates with Letsencrypt as well?
If I'm not wrong, the node will continue to run with expired certificate, but if a node has any issue and leaves the cluster, it will not be able to rejoin, which can impact in the availability of the cluster.
---
### Author:  [@piyushgupta](https://discuss.elastic.co/u/piyushgupta)
#### Post date: [March 17, 2025, 1:44pm UTC](https://discuss.elastic.co/t/running-elastic-search-cluster-with-expired-tls-ceritificate/375996/3 "2025-03-17T13:44:40Z")
Thanks @leandrojmp for the reply , These certificates xpack.security.transport.\* are not using LetEncrypt and its valid for next 3 years ,
My query is only related to xpack.security.http.\* certificate , if i can let this certificate expires , will it impact cluster or its operation in future , like restart or node expansion like adding new nodes , removing other nodes or any other cluster operation
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [March 17, 2025, 2:16pm UTC](https://discuss.elastic.co/t/running-elastic-search-cluster-with-expired-tls-ceritificate/375996/4 "2025-03-17T14:16:21Z")
> [@piyushgupta](#):
>
> My query is only related to xpack.security.http.\* certificate , if i can let this certificate expires , will it impact cluster or its operation in future , like restart or node expansion like adding new nodes , removing other nodes or any other cluster operation
The `xpack.security.http.*` is used by Clients, not nodes, the nodes communicate using the `xpack.security.transport.*` setting, so I don't think it will impact operations for the nodes.
It will impact Kibana however, because Kibana is a client.