# What is the usecasae of --ca-dn when using elasticsearch-certutil utility

**URL:** <https://discuss.elastic.co/t/what-is-the-usecasae-of-ca-dn-when-using-elasticsearch-certutil-utility/374961>\
**Category:** Elasticsearch\
**Created:** [February 24, 2025, 7:38pm UTC](https://discuss.elastic.co/t/what-is-the-usecasae-of-ca-dn-when-using-elasticsearch-certutil-utility/374961 "2025-02-24T19:38:20Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jack\_a](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jack_a/32/133082_2.png) [@jack\_a](https://discuss.elastic.co/u/jack_a)\
**Post date:** [February 24, 2025, 7:38pm UTC](https://discuss.elastic.co/t/what-is-the-usecasae-of-ca-dn-when-using-elasticsearch-certutil-utility/374961/1 "2025-02-24T19:38:20Z")

</div>

the `--ca-dn` option while using `cert` seems to only be applicable with `--self-signed` option, for example

`./elasticsearch-certutil cert --self-signed --ca-dn xyz --pem --out /usr/share/elasticsearch/bin/test/out5.zip`

But in this case when i check the generated cert content for example with the command

`openssl x509 -in instance.crt -text -noout`

Both `issuer CN` and `subject CN` is set as `instance` . Can you please show me with an example what it is the use case of `--ca-dn` when using `cert` command and which part of the certificated is effected by the parameter?

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [February 24, 2025, 11:32pm UTC](https://discuss.elastic.co/t/what-is-the-usecasae-of-ca-dn-when-using-elasticsearch-certutil-utility/374961/2 "2025-02-24T23:32:08Z")

</div>

It doesn't do anything useful in current versions of certutil

In older versions it was possible to generate a CA on the fly while you generated certificates, but that option has been removed.

---

<div class="post-metadata">

**Author:** ![jack\_a](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jack_a/32/133082_2.png) [@jack\_a](https://discuss.elastic.co/u/jack_a)\
**Post date:** [February 25, 2025, 5:31am UTC](https://discuss.elastic.co/t/what-is-the-usecasae-of-ca-dn-when-using-elasticsearch-certutil-utility/374961/3 "2025-02-25T05:31:50Z")

</div>

Thanks. It would be nice if the option would not show up when you run `elasticsearch-certutil cert --help` (it is kind of confusing) but anyway thanks for the reply.