# Updating xpack certificates to a new CA in an active Elasticsearch cluster without downtime

**URL:** <https://discuss.elastic.co/t/updating-xpack-certificates-to-a-new-ca-in-an-active-elasticsearch-cluster-without-downtime/385871>\
**Category:** Elasticsearch\
**Created:** [April 13, 2026, 1:45pm UTC](https://discuss.elastic.co/t/updating-xpack-certificates-to-a-new-ca-in-an-active-elasticsearch-cluster-without-downtime/385871 "2026-04-13T13:45:22Z")\
**Posts on this page:** 3\
**Page:** 2

<div class="post-metadata">

**Author:** ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)\
**Post date:** [May 11, 2026, 11:22am UTC](https://discuss.elastic.co/t/updating-xpack-certificates-to-a-new-ca-in-an-active-elasticsearch-cluster-without-downtime/385871/21 "2026-05-11T11:22:18Z")

</div>

> [@Anup\_Kumar](#):
>
> Or are we still ultimately bound to the full-cluster-restart approach that @rdennehy outlined?

You will have to try it to be sure, you are well off the beaten path and it would be far too time-consuming for me to try and reproduce it myself. But I believe you can do everything we've suggested as a sequence of rolling restarts.

---

<div class="post-metadata">

**Author:** ![Anup\_Kumar](https://avatars.discourse-cdn.com/v4/letter/a/9d8465/32.png) [@Anup\_Kumar](https://discuss.elastic.co/u/Anup_Kumar)\
**Post date:** [May 15, 2026, 10:33am UTC](https://discuss.elastic.co/t/updating-xpack-certificates-to-a-new-ca-in-an-active-elasticsearch-cluster-without-downtime/385871/22 "2026-05-15T10:33:21Z")

</div>

Thanks @DavidTurner for the guidance on using client\_authentication: none with truststore - this approach has worked for us! We've successfully deployed the truststore across our cluster and implemented the dual-trust configuration. Initial testing looks great - we migrated one test node to the new CA certificate and it joined the cluster seamlessly while other nodes are still using the old CA.

The mixed CA topology is stable so far with no connectivity issues. Currently testing the full migration workflow in our test environment and will update if any issues arise during the broader rollout. Really appreciate pointing us in the right direction on this!

---

<div class="post-metadata">

**Author:** ![Anup\_Kumar](https://avatars.discourse-cdn.com/v4/letter/a/9d8465/32.png) [@Anup\_Kumar](https://discuss.elastic.co/u/Anup_Kumar)\
**Post date:** [May 15, 2026, 12:39pm UTC](https://discuss.elastic.co/t/updating-xpack-certificates-to-a-new-ca-in-an-active-elasticsearch-cluster-without-downtime/385871/23 "2026-05-15T12:39:34Z")

</div>

Also a big thank you to @leandrojmp , @RainTown , and @rdennehy for the deep-dive analysis and the alternative workarounds suggested!

[Previous page](https://discuss.elastic.co/t/updating-xpack-certificates-to-a-new-ca-in-an-active-elasticsearch-cluster-without-downtime/385871.md?page=1)