The sgadmin tool can be used to trigger a reload of the TLS certificates on a running cluster. You can use this feature to change certificates, including the root CA without the need for a cluster restart.
Please read the TLS reload instruction guide before changing the certificates on a production Elasticsearch cluster
|-rlhttpcerts,–reload-http-certs||Trigger a reload of the certificates on the HTTP layer|
|-rltransportcerts,–reload-transport-cert||Trigger a reload of the certificates on the HTTP layer|