Document transport TLS certificate expiry behavior

deploy-manage/deploy/self-managed/_snippets/security-files.md

@@ -21,4 +21,6 @@ Use the following command to retrieve the password for `transport.p12`:
 
 ```sh
 bin/elasticsearch-keystore show xpack.security.transport.ssl.keystore.secure_password
-```
+```
+
+Security auto-configuration sets `certs/transport.p12` as both the transport keystore and truststore on each node. Auto-generated transport certificates have a long validity period and are unlikely to expire under normal operation. To add nodes, use an [enrollment token](/deploy-manage/maintenance/add-and-remove-elasticsearch-nodes.md#_enroll_nodes_in_an_existing_cluster_5) rather than copying `transport.p12` between nodes. For manual transport TLS setup and certificate expiry behavior when the same PKCS#12 file is shared across all nodes, refer to [Set up transport TLS](/deploy-manage/security/set-up-basic-security.md).

deploy-manage/security/set-up-basic-security.md

@@ -113,7 +113,7 @@ Complete the following steps **for each node in your cluster**. To join the same
 
     3. Add the following settings to enable internode communication and provide access to the node’s certificate.
 
-        Because you are using the same `elastic-certificates.p12` file on every node in your cluster, set the verification mode to `certificate`:
+        Use the same `elastic-certificates.p12` file on every node in your cluster. This file acts as a cluster-membership key: any node with a copy of the file can join the cluster and will trust other nodes using the same file. Because every node presents the same certificate, set the verification mode to `certificate`:
 
         ```yaml
         xpack.security.transport.ssl.enabled: true
@@ -123,6 +123,10 @@ Complete the following steps **for each node in your cluster**. To join the same
         xpack.security.transport.ssl.truststore.path: elastic-certificates.p12
         ```
 
+        ::::{note}
+        When the same file is configured as both the keystore and truststore, or when only `keystore.path` is set and {{es}} uses that file as the truststore, peer node certificates in the file are trusted directly. The same behavior applies if a peer's leaf certificate is listed in `xpack.security.transport.ssl.certificate_authorities`. In these configurations, {{es}} does not reject connections from nodes presenting an expired certificate that is directly trusted, regardless of the `verification_mode` setting. Internode communication remains encrypted, and the cluster can continue to operate normally, including restarts and adding new nodes that use the same certificate material.
+        ::::
+
         1. If you want to use hostname verification, set the verification mode to `full`. You should generate a different certificate for each host that matches the DNS or IP address. See the `xpack.security.transport.ssl.verification_mode` parameter in [TLS settings](elasticsearch://reference/elasticsearch/configuration-reference/security-settings.md#transport-tls-ssl-settings).
 
 3. If you entered a password when creating the node certificate, run the following commands to store the password in the {{es}} keystore: