elasticsearch-certutil

Generate CA certificate

$ elasticsearch-certutil ca

$ elasticsearch-certutil cert --ca [elastic-stack-ca.p12]

$ elasticsearch-certutil csr

$ elasticsearch-certutil http

$ elasticsearch-certutil ca --pem

elasticsearch-certutil mode [options]

elasticsearch-certutil generates certificates and certificate authorities for securing Elasticsearch clusters. It simplifies the certificate management process by automating the creation of self-signed certificates, certificate authorities, and certificate signing requests.
The tool is essential for enabling TLS/SSL encryption on both the transport layer (node-to-node communication) and the HTTP layer (client API access). It generates certificates in PKCS#12 or PEM format and can include multiple DNS names and IP addresses for cluster deployments.
elasticsearch-certutil streamlines security configuration required for production Elasticsearch deployments and enables features like Elastic Stack security.

--ca file

CA certificate to use.

Output file path.

Output in PEM format.

DNS names for certificate.

IP addresses for certificate.

Password for output file.

ca

Generate certificate authority.

Generate X.509 certificates.

Generate certificate signing requests.

Generate HTTP layer certificates.

elasticsearch(1), elasticsearch-keystore(1)