Replacing the ElasticSearch Certificate

This procedure describes how to replace the Elasticsearch certificate.

Before you begin

• Verify that the Elasticsearch certificate PEM file is available, as described in Creating an Elasticsearch Certificate.
• Verify that the private key PEM file is available, as described in Creating a CA Certificate and Key.

Begin

1. Navigate to one of the following locations:
   • UNIX: $HOME/ctm_em/Elasticsearch/config
   • Windows: %EM_HOME%\Elasticsearch\config
2. Place the certificate and key files in the following folder:

   Elasticsearch/config/certificates

3. In the Elastic.yml file in the config folder, update the following properties with the paths and file names of the key and certificate files:
   • opendistro_security.ssl.transport.pemcert_filepath: certificates/elk-transport-crt.pem
   • opendistro_security.ssl.transport.pemkey_filepath: certificates/elk-transport-key.pem
   • opendistro_security.ssl.transport.pemtrustedcas_filepath: certificates/elastic_ca.pem
   • opendistro_security.ssl.http.pemcert_filepath: certificates/elk-node-crt.pem
   • opendistro_security.ssl.http.pemkey_filepath: certificates/elk-node-key.pem
   • opendistro_security.ssl.http.pemtrustedcas_filepath: certificates/elastic_ca.pem
   • opendistro_security.authcz.admin_dn:

     - 'CN=CONTROL-M_EM_ES_admin,O=BMC_Software_Ltd,L=Houston,ST=Texas,C=US'

     EXAMPLE: opendistro_security.nodes_dn:

     - 'CN=CONTROL-M_EM_ES_transport,O=BMC_Software_Ltd,L=Houston,ST=Texas,C=US'

   The Elasticsearch certificate is replaced.