Azure module setup with elastic https security

I'm trying to run setup for the logstash (7.5.0) azure module. All examples are without security but we are using elasticsearch https.

I'm getting errors:

[2020-01-14T09:42:45,431][ERROR][logstash.licensechecker.licensereader] Unable to retrieve license information from license server {:message=>"Elasticsearch Unreachable: [https://met-elk-csg06.missouri.edu:9200/][Manticore::ClientProtocolException] PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target"}

[2020-01-14T09:42:45,506][ERROR][logstash.licensechecker.modulelicensechecker] Failed to fetch X-Pack information from Elasticsearch. This is likely due to failure to reach a live Elasticsearch cluster.

[2020-01-14T09:42:45,513][WARN ][logstash.config.modulescommon] The azure module is not enabled. Please check the logs for additional information.

I think the key is "unable to find valid certification path", per tcpdump, no connection is attempted. I added these variables to the module config but they don't seem to make any difference:

   ....
   var.elasticsearch.cacerts: "/etc/logstash/certs/https_interm.cer"
   var.elasticsearch.user:  userid
   var.elasticsearch.password: password
   ....

These values work in elasticsearch output plugins (in other logstash instances)

Any ideas or any pointers to where this is documented?

Thanks