# Why does elasticsearch use PKCS#12, while Kibana needs PEM?

**URL:** https://discuss.elastic.co/t/why-does-elasticsearch-use-pkcs-12-while-kibana-needs-pem/161756
**Category:** Kibana
**Tags:** elastic-stack-security
**Created:** [December 20, 2018, 8:42pm UTC](https://discuss.elastic.co/t/why-does-elasticsearch-use-pkcs-12-while-kibana-needs-pem/161756 "2018-12-20T20:42:06Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [December 21, 2018, 2:53am UTC](https://discuss.elastic.co/t/why-does-elasticsearch-use-pkcs-12-while-kibana-needs-pem/161756/2 "2018-12-21T02:53:26Z")

</div>

Elasticsearch can use PKCS#12 or PEM, and our certificate tool (`elasticsearch-certutil`) can work with and generate either.

We default to PKCS#12 in the docs and in the tool because it produces a single file that contains all the certificate and key information that is needed for a node, so configuration is simpler.

Unfortunately the PKCS#12 support in Node.JS isn't as feature rich as in Java, so we aren't able to support PKCS#12 CAs in Kibana right now.

---

_[View the full topic](https://discuss.elastic.co/t/why-does-elasticsearch-use-pkcs-12-while-kibana-needs-pem/161756)._