What is the usecasae of --ca-dn when using elasticsearch-certutil utility

Elastic Stack Elasticsearch
1

the --ca-dn option while using cert seems to only be applicable with --self-signed option, for example

./elasticsearch-certutil cert --self-signed --ca-dn xyz --pem --out /usr/share/elasticsearch/bin/test/out5.zip

But in this case when i check the generated cert content for example with the command

openssl x509 -in instance.crt -text -noout

Both issuer CN and subject CN is set as instance . Can you please show me with an example what it is the use case of --ca-dn when using cert command and which part of the certificated is effected by the parameter?

2

It doesn't do anything useful in current versions of certutil

In older versions it was possible to generate a CA on the fly while you generated certificates, but that option has been removed.

3

Thanks. It would be nice if the option would not show up when you run elasticsearch-certutil cert --help (it is kind of confusing) but anyway thanks for the reply.