#     Switching Elasticsearch from HTTP to HTTPS with Active Fleet Agents

**URL:** https://discuss.elastic.co/t/switching-elasticsearch-from-http-to-https-with-active-fleet-agents/386339
**Category:** Elasticsearch
**Created:** [May 14, 2026, 3:08pm UTC](https://discuss.elastic.co/t/switching-elasticsearch-from-http-to-https-with-active-fleet-agents/386339 "2026-05-14T15:08:17Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![saeedelfiky](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/saeedelfiky/32/147551_2.png) [@saeedelfiky](https://discuss.elastic.co/u/saeedelfiky)
#### Post date: [May 14, 2026, 3:08pm UTC](https://discuss.elastic.co/t/switching-elasticsearch-from-http-to-https-with-active-fleet-agents/386339/1 "2026-05-14T15:08:18Z")

</div>

Hey everyone,

I currently have a self-managed Elastic Stack environment running over HTTP with:

- Elasticsearch

- Kibana

- Fleet

- Around 20 connected Elastic Agent instances

I want to migrate Elasticsearch from HTTP to HTTPS without breaking Fleet communication or reinstalling all agents.

My main concern is:

- updating Fleet outputs safely

- handling CA trust for existing agents

- Fleet Server reconfiguration

- avoiding re-enrollment of all endpoints

For people who already did this migration:

- What’s the safest order of operations?

- Did the existing agents reconnect automatically after updating Fleet output?

- Is using CA fingerprint enough, or should I distribute the full CA cert?

- Any common pitfalls I should watch for?