# Should i use the same elasticsearch p12 keystore and truststore for every node in the cluster?

**URL:** <https://discuss.elastic.co/t/should-i-use-the-same-elasticsearch-p12-keystore-and-truststore-for-every-node-in-the-cluster/321514>\
**Category:** Elasticsearch\
**Created:** [December 19, 2022, 5:29am UTC](https://discuss.elastic.co/t/should-i-use-the-same-elasticsearch-p12-keystore-and-truststore-for-every-node-in-the-cluster/321514 "2022-12-19T05:29:25Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![mikhatanu](https://avatars.discourse-cdn.com/v4/letter/m/ba8739/32.png) [@mikhatanu](https://discuss.elastic.co/u/mikhatanu)\
**Post date:** [December 19, 2022, 5:29am UTC](https://discuss.elastic.co/t/should-i-use-the-same-elasticsearch-p12-keystore-and-truststore-for-every-node-in-the-cluster/321514/1 "2022-12-19T05:29:25Z")

</div>

Hello, i'm updating the ssl transport with an external CA (not generated by elastic). The documentation tells to use the same p12 keystore and truststore for ever node:  
[Set up basic security for the Elastic Stack | Elasticsearch Guide [8.5] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-basic-setup.html#:~:text=On%20every%20node%20in%20your%20cluster%2C%20copy%20the%20elastic%2Dcertificates.p12%20file%20to%20the%20%24ES_PATH_CONF%20directory).  
Should i do this? or should i generate new truststore and keystore for every node?

---

<div class="post-metadata">

**Author:** ![dadiasish](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadiasish/32/114221_2.png) [@dadiasish](https://discuss.elastic.co/u/dadiasish)\
**Post date:** [December 19, 2022, 5:40am UTC](https://discuss.elastic.co/t/should-i-use-the-same-elasticsearch-p12-keystore-and-truststore-for-every-node-in-the-cluster/321514/2 "2022-12-19T05:40:15Z")

</div>

No, you do not need to generate again and again for each node. You can use the same p12 cert file for each node if all the node or client IP's and hostnames are added to it.

---

<div class="post-metadata">

**Author:** ![mikhatanu](https://avatars.discourse-cdn.com/v4/letter/m/ba8739/32.png) [@mikhatanu](https://discuss.elastic.co/u/mikhatanu)\
**Post date:** [December 19, 2022, 6:03am UTC](https://discuss.elastic.co/t/should-i-use-the-same-elasticsearch-p12-keystore-and-truststore-for-every-node-in-the-cluster/321514/3 "2022-12-19T06:03:06Z")

</div>

how do you add each node to the p12 cert file? is it when generating CSR?

---

<div class="post-metadata">

**Author:** ![dadiasish](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadiasish/32/114221_2.png) [@dadiasish](https://discuss.elastic.co/u/dadiasish)\
**Post date:** [December 19, 2022, 6:05am UTC](https://discuss.elastic.co/t/should-i-use-the-same-elasticsearch-p12-keystore-and-truststore-for-every-node-in-the-cluster/321514/4 "2022-12-19T06:05:12Z")

</div>

Yes, you are right.

It should be done while generating the .csr file before getting it signed.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 16, 2023, 6:05am UTC](https://discuss.elastic.co/t/should-i-use-the-same-elasticsearch-p12-keystore-and-truststore-for-every-node-in-the-cluster/321514/5 "2023-01-16T06:05:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.