This is not about the permissions, but the fact that you need to move the certificates into the config directory of Elasticsearch.
Elasticsearch is using the java security manager on startup, that is configured by a rule, that only allows opening of files in the config directory but not in arbitrary directories.