# changing CA and host certificates

**URL:** <https://forum.search-guard.com/t/changing-ca-and-host-certificates/495>\
**Category:** Search Guard\
**Created:** [June 27, 2017, 2:00pm UTC](https://forum.search-guard.com/t/changing-ca-and-host-certificates/495 "2017-06-27T14:00:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Fabien\_Wernli](https://avatars.discourse-cdn.com/v4/letter/f/48db29/32.png) [@Fabien\_Wernli](https://forum.search-guard.com/u/Fabien_Wernli)\
**Post date:** [June 27, 2017, 2:00pm UTC](https://forum.search-guard.com/t/changing-ca-and-host-certificates/495/1 "2017-06-27T14:00:58Z")

</div>

Hi,

What’s the procedure to change all host certificates (and possibly also the CA)?  
I guess this requires a full cluster restart and restart of all nodes?

Cheers

---

<div class="post-metadata">

**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\
**Post date:** [June 27, 2017, 3:18pm UTC](https://forum.search-guard.com/t/changing-ca-and-host-certificates/495/2 "2017-06-27T15:18:39Z")

</div>

New ssl certificates signed by the same root CA (or intermediate CA) can be applied in a rolling restart manner.

When your CA changes you can first update your truststore in a rolling manner adding the new CA (but keeping the old).  
Then change the certs in a rolling restart manner. Then removing the old CA from your trustores in a rolling restart manner.

> **···**
>
> > Am 27.06.2017 um 16:00 schrieb Fabien Wernli \<swissunix@gmail.com\>:
> > 
> > Hi,
> > 
> > What's the procedure to change all host certificates (and possibly also the CA)?  
> > I guess this requires a full cluster restart and restart of all nodes?
> > 
> > Cheers
> > 
> > --  
> > You received this message because you are subscribed to the Google Groups "Search Guard" group.  
> > To unsubscribe from this group and stop receiving emails from it, send an email to search-guard+unsubscribe@googlegroups.com.  
> > To post to this group, send email to search-guard@googlegroups.com.  
> > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/8a2ed7ca-617a-406c-bc3f-c70b3f6539e7%40googlegroups.com\](https://groups.google.com/d/msgid/search-guard/8a2ed7ca-617a-406c-bc3f-c70b3f6539e7%40googlegroups.com%5C).  
> > For more options, visit [https://groups.google.com/d/optout\](https://groups.google.com/d/optout%5C).

---

<div class="post-metadata">

**Author:** ![Fabien\_Wernli](https://avatars.discourse-cdn.com/v4/letter/f/48db29/32.png) [@Fabien\_Wernli](https://forum.search-guard.com/u/Fabien_Wernli)\
**Post date:** [June 28, 2017, 3:06pm UTC](https://forum.search-guard.com/t/changing-ca-and-host-certificates/495/3 "2017-06-28T15:06:11Z")

</div>

Thanks!