Hi, I had the same issue, but not in docker.
It stems from the fact that the workstation agent (as of 7.11.2) igniores the local trusted root certificate store and wants a hard coded path to the ca certificate.
You can see the solution here: https://discuss.elastic.co/t/elastic-agent-healthy-but-no-data-streams/265699
I'd like to post this as a bug - where should I do that?