anchor.diff:  
   [source,shell]
   ----
  -bin/elasticsearch-certutil http
  +./bin/elasticsearch-certutil http
   ----
   
   This command guides you through the process of generating the appropriate
   certificates for use in {es} and {kib}. If you created a CA for your cluster,
   you can re-use it by supplying its location when prompted.
  +
  +NOTE: The first question that the `elasticsearch-certutil` tool prompts you
  +with is whether you want to generate a Certificate Signing Request (CSR).
  +Answer `y` if a trusted authority, such as in internal security team or a
  +commercial certificate authority, will sign your certificates. Answer `n` if
  +you have access to a trusted CA and will sign your own certificates.
  +
  +The output is a `.zip` file containing one directory each for both Elasticsearch
  +and Kibana:
  +
  +[source,shell]
  +----
  +/elasticsearch
  +|_ README.txt
  +|_ http.p12
  +|_ sample-elasticsearch.yml
  +
  +/kibana
  +|_ README.txt
  +|_ elasticsearch-ca.pem
  +|_ sample-kibana.yml
  +----
   --
   
   . Copy the node certificate to the appropriate locations.
  
positive.code: 
  [source,shell]
  ----
  bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12
  ----
  You are prompted for a password. You can enter a password for your
  certificate and key, or you can leave the password blank.
  
negative.code: 
  [source,shell]
  ----
  ./bin/elasticsearch-certutil ca
  ----
  
  You can configure the cluster to trust all nodes that have a certificate that
  