APM server can't access elasticsearch

[marone (Marwane Chahoud)]

Kibana version: 7.12

Elasticsearch version: 7.12

APM Server version: 7.12

APM Agent language and version: nodejs apm

Browser version: Chrome 89.0.4389.128 (64 bits)

Original install method (e.g. download page, yum, deb, from source, etc.) and version: deb

Fresh install or upgraded from other version? Fresh install

Installed my elastic stack including APM on Azure virtual machine

Description of the problem including expected versus actual behavior. Please include screenshots (if relevant):

Steps to reproduce:
I have two VMs in Azure (node1 and node2) each vm running elasticsearch instance, I installed APM server in node2, and I have a simple nodejs app in node1. I already have kibana running in node1. I installed the npm package in my nodejs app and added it to app.js file. I already enabled xpack security in my elasticsearch cluster using TLS and https with a self signed certificates (followed this tutorial and enabled https)

Errors in browser console (if relevant):

Provide logs and/or server output (if relevant):
activated logging in apm-server.yml and got the following:

{"log.level":"error","@timestamp":"2021-04-23T15:45:33.861Z","log.logger":"publisher_pipeline_output","log.origin":{"file.name":"pipeline/output.go","file.line":154},"message":"Failed to connect to backoff(elasticsearch(https://localhost:9200)): Get \"https://localhost:9200\": dial tcp 127.0.0.1:9200: connect: connection refused","ecs.version":"1.6.0"}

in apm-server.yml file, I added elasticsearch ca certificate but don't know where to locate ssl certificate and client certificate, here is my conf of apm-server.yml:

kibana:
  host: "MyVMname.myregion.cloudapp.azure.com:5601"
  protocol: "https"
  username: "elastic"
  password: "changeme"
  ssl.enabled: true
  ssl.verification_mode: none
  ssl.certificate_authorities: ["/etc/apm-server/config/certs/elasticsearch-ca.pem"]
  # Certificate for SSL client authentication.
  #ssl.certificate: "/etc/pki/client/cert.pem"
  # Client Certificate Key
  #ssl.key: "/etc/pki/client/cert.key"


output.elasticsearch:
  hosts: ["localhost:9200", "node1:9200"]
  protocol: "https"
  username: "elastic"
  password: "changeme"
  ssl.enabled: true
  ssl.verification_mode: none
  ssl.certificate_authorities: ["/etc/apm-server/config/certs/elasticsearch-ca.pem"]
  # Certificate for SSL client authentication.
  #ssl.certificate: "/etc/pki/client/cert.pem"
  # Client Certificate Key
  #ssl.key: "/etc/pki/client/cert.key"

the error I have due to not specifying ssl client ? if so which certificate should I add to yml file ?