# Store certificated in keystore **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [March 16, 2022, 6:30pm UTC](https://discuss.elastic.co/t/store-certificated-in-keystore/299889 "2022-03-16T18:30:40Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![ginolegigot](https://avatars.discourse-cdn.com/v4/letter/g/87869e/32.png) [@ginolegigot](https://discuss.elastic.co/u/ginolegigot)\ **Post date:** [March 16, 2022, 6:30pm UTC](https://discuss.elastic.co/t/store-certificated-in-keystore/299889/1 "2022-03-16T18:30:40Z")
Hello, If i properly understood this [doc](https://www.elastic.co/guide/en/elasticsearch/reference/7.6/configuring-tls.html#tls-transport) and especially this paragraph: > The `elasticsearch-certutil` outputs a PKCS#12 keystore which includes the CA certificate as a trusted certificate entry. This allows for the keystore to also be used as a truststore. In this case, the path value should match the `keystore.path` value. Note, however, that this is not the general rule. There are keystores that cannot be used as truststores, only [specifically crafted ones can](https://www.elastic.co/guide/en/elasticsearch/reference/7.6/security-settings.html#pkcs12-truststore-note) The keystore can also be used as truststore. In this keystore we store the certificate password. And i was wondering why we could not store the certificate itself in the keystore, instead of storing it on the node and explicitng a path to look for this certificate ? Maybe i dont properly understand the role of the keystore, could you enlighten me about this matter ? Thanks! ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [March 17, 2022, 12:17am UTC](https://discuss.elastic.co/t/store-certificated-in-keystore/299889/2 "2022-03-17T00:17:18Z")
Unfortunately we have overlapping names that can sometimes be confusing. Within Elasticsearch's certificate configuration, a file that can store a collection of certificates along with their private keys is known as a KeyStore (which is the terminology that Java uses). Such keystores are typically in PKCS#12 or JKS format. A file that can store a collection of trusted certificates (typically CAs), without their private keys, is known as a TrustStore (also a terminology from Java). Generally, keystores and truststores use the same file format, so most truststores are also in PKCS#12 or JKS fomat. Because these files (both keystores and truststores) are _collections_ of certificates - that is, they can contain many certificates - it is possible for a single file to contain _private key entries_ (that is, a certificate + private key) and _trusted certificate entries_ (that is, public certificates without keys) at the same time, which makes it both a keystore and a truststore, and you can use it for either, or both. Elasticsearch also has a file in its configuration directory called `elasticsearch.keystore`, and you can view and modify the contents of that file via the `elasticsearch-keystore` command. That "keystore" stores "secrets" like passwords, and is not the same type of keystore as a _certificate keystore_ described above. It isn't in a standard format (that is, it is not PKCS#12 or JKS) and most of the time it doesn't store "private keys" just "secrets". The `elasticsearch.keystore` cannot be used as a keystore, nor a truststore, for configuring SSL. All SSL certificates + keys need to be stored on the filesystem in either a certificate keystore (PKCS#12 or JKS) or as individual files in PEM format (`.crt`, `.key`, `.pem`, etc). ---
**Author:** ![ginolegigot](https://avatars.discourse-cdn.com/v4/letter/g/87869e/32.png) [@ginolegigot](https://discuss.elastic.co/u/ginolegigot)\ **Post date:** [March 17, 2022, 9:51am UTC](https://discuss.elastic.co/t/store-certificated-in-keystore/299889/3 "2022-03-17T09:51:26Z")
Hello Mr V, Your answer is amazing, I understood everything! Thanks a lot for your time, Have a great day! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 14, 2022, 9:52am UTC](https://discuss.elastic.co/t/store-certificated-in-keystore/299889/4 "2022-04-14T09:52:18Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.