# Certificates rollover (not demo certs)

**URL:** <https://forum.search-guard.com/t/certificates-rollover-not-demo-certs/915>\
**Category:** Search Guard\
**Created:** [May 16, 2018, 11:29am UTC](https://forum.search-guard.com/t/certificates-rollover-not-demo-certs/915 "2018-05-16T11:29:38Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nicolas\_Kowenski](https://avatars.discourse-cdn.com/v4/letter/n/8491ac/32.png) [@Nicolas\_Kowenski](https://forum.search-guard.com/u/Nicolas_Kowenski)\
**Post date:** [May 16, 2018, 11:29am UTC](https://forum.search-guard.com/t/certificates-rollover-not-demo-certs/915/1 "2018-05-16T11:29:38Z")

</div>

Hi all.  
First of all, thanks to the search guard team you are doing a great job!.

I have a cluster running with my own certs, (generated with tlstool) and i need to rollover the certs.

I allready created the new ones and copied to the config folder.  
If i restart one node, it fails to load because the new cert is different to the active one (certificate\_unknown). So I need to reastart all the nodes.

But if i do that i will end with all the indices in red status?

I am running elasticsearch in containers, and mounted the container folder /usr/share/elasticsearch/data into the host to keep data when container restarts. The problem is when i restart the container elastic start to moving shards to rebalance shards/replicas, and for my previus experience if i restart all of them without a batch interval of 10 mins (the time needed to rebalance) i loose data and end with red indices.

its there another way to rollover certificates? or a best way to approach this?

thanks to you all!

edit: i was missing to change the pemkey pass. so doing it i receive also

PKIX path validation failed: java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors