Editing OpenSearch Cluster Installation (section)

== Create Certificates ==
There are three types of certificates used in OpenSearch:

* CA certificate - one for the whole cluster to validate everything else
* Node certificate/key - identifies the node for internal cluster communications (transport layer) and data ingest (http layer)
** the CN must be the FQDN of the node
** even though OpenSearch doesn't seem to use them at this point, there should be SANs for the full FQDN, the short hostname, and the node's IP address
* User certificate/key - identifies a specific OpenSearch user
** the CN is a username in OpenSearch (explicit or implicit)
** username is used to determine roles/privileges in the cluster
** Need at least one cert for admin authentication

Node and User certificates must all be signed by the cluster CA, and '''all keys must be in PKCS8 format'''.  If user certificates are to be used for authentication by logstash, they must be imported (along with the key and CA) into a PKCS12 (.p12) keystore.  The OpenSearch documentation has a good piece on [https://opensearch.org/docs/latest/security-plugin/configuration/generate-certificates/ how to create certificates].

In summary, create the following certificates/keys

# CA certificate/key
# For each cluster node:
#* <node>.crt
#* <node>-pkcs8.key
# For each user:
#* <user>.crt
#* <user>-pkcs8.key
#* <user>.p12

All these should be created and available for the configuration of each cluster node below.