anchor.diff:  
   [source,shell]
   ----
  -bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12
  +./bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12
   ----
   You are prompted for a password. You can enter a password for your
   certificate and key, or you can leave the password blank.
  
positive.code: 
  [source,shell]
  ----
  bin/elasticsearch-certutil ca
  ----
  
  You can configure the cluster to trust all nodes that have a certificate that
  
negative.code: 
  [source,shell]
  ----
  ./bin/elasticsearch-certutil http
  ----
  
  This command guides you through the process of generating the appropriate
  certificates for use in {es} and {kib}. If you created a CA for your cluster,
  you can re-use it by supplying its location when prompted.
  
  NOTE: The first question that the `elasticsearch-certutil` tool prompts you
  with is whether you want to generate a Certificate Signing Request (CSR).
  Answer `y` if a trusted authority, such as in internal security team or a
  commercial certificate authority, will sign your certificates. Answer `n` if
  you have access to a trusted CA and will sign your own certificates.
  
  The output is a `.zip` file containing one directory each for both Elasticsearch
  and Kibana:
  
  [source,shell]
  ----
  /elasticsearch
  |_ README.txt
  |_ http.p12
  |_ sample-elasticsearch.yml
  
  /kibana
  |_ README.txt
  |_ elasticsearch-ca.pem
  |_ sample-kibana.yml
  ----
  --
  
  . Copy the node certificate to the appropriate locations.
  