# Trust two different certs on two nodes **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [June 3, 2020, 9:57pm UTC](https://discuss.elastic.co/t/trust-two-different-certs-on-two-nodes/235642 "2020-06-03T21:57:47Z")\ **Posts on this page:** 1\ **Showing post:** 11
**Author:** ![jthoni](https://avatars.discourse-cdn.com/v4/letter/j/b9e5f3/32.png) [@jthoni](https://discuss.elastic.co/u/jthoni)\ **Post date:** [June 16, 2020, 8:17pm UTC](https://discuss.elastic.co/t/trust-two-different-certs-on-two-nodes/235642/11 "2020-06-16T20:17:34Z")
I think I got it (at least I can use the same pfx from two nodes now without error). The key was in here: > [@SSLHandshakeException when enabling security](https://discuss.elastic.co/t/sslhandshakeexception-when-enabling-security/186680): > > Hi we have a working cluster but when we enable xpack security the transport communication fails. Configuration: bootstrap.memory\_lock: true cluster.initial\_master\_nodes: - elk.mydomain.dk - elk-02.mydomain.dk - elk-03.mydomain.dk cluster.name: elasticsearch-prod discovery.seed\_hosts: - elk-02.mydomain.dk - elk-03.mydomain.dk http.port: 9200 network.host: elk.mydomain.dk node.data: false node.ingest: true node.master: true node.max\_local\_storage\_nodes: 1 node.name: ELK path.dat… First off, my cert did not have the full trust chain, so that was a problem. What resolved it for me was Got a new sslCert for both Client and Server auth (Extended Key Usage) I exported this to PEM as keyStore.pem: `openssl pkcs12 -in myCert.pfx -out keyStore.pem -nokeys -nodes` I edited the PEM file to remove out my cert and just keep the CAs. Instead of specifying truststore, I added: xpack.security.transport.ssl.certificate\_authorities: ["keyStore.pem"] When starting up and running \_xpack/ssl/certificates, I see the CAs listed in both the PEM and pfx. Second node is able to join as well. --- _[View the full topic](https://discuss.elastic.co/t/trust-two-different-certs-on-two-nodes/235642)._