[ES 7.3.2] SSLHandshakeException: No available authentication scheme

Master (elastic1):

# ---------------------------------- Network -----------------------------------#
network.host: 0.0.0.0
#
# Set a custom port for HTTP:
#
http.port: 9200

#for local nodes
transport.profiles.default.port: 9300
transport.profiles.default.bind_host: 0.0.0.0
transport.profiles.default.publish_host: 172.18.1.48

# for ext. nodes
transport.profiles.dc.port: 9301
transport.profiles.dc.bind_host: 0.0.0.0
transport.profiles.dc.publish_host: xx.xx.xx.xx

#
# For more information, consult the network module documentation.
#
# --------------------------------- Discovery ----------------------------------
## Pass an initial list of hosts to perform discovery when this node is started:
# The default list of hosts is ["127.0.0.1", "[::1]"]
 discovery.seed_hosts: ["elastic1", "elastic2", "elastic3", "elasticdc1"]
#
# Bootstrap the cluster using an initial set of master-eligible nodes:
#
cluster.initial_master_nodes: ["elastic1", "elastic2"]
#
# For more information, consult the discovery and cluster formation module documentation.
## ---------------------------------- Gateway -----------------------------------
## Block initial recovery after a full cluster restart until N nodes are started:
# gateway.recover_after_nodes: 3
## For more information, consult the gateway module documentation.#
# ---------------------------------- Various -----------------------------------
## Require explicit names when deleting indices:
##action.destructive_requires_name: true

# ENABLES SEC. - autogens an elastic user password
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: elastic-certificates.p12
xpack.license.self_generated.type: basic

Int Host:

# ---------------------------------- Network -----------------------------------## Set the bind address to a specific IP (IPv4 or IPv6):#
network.host: 0.0.0.0
#
# Set a custom port for HTTP:
#
http.port: 9200
#
# For more information, consult the network module documentation.
#
# --------------------------------- Discovery ----------------------------------
#
# Pass an initial list of hosts to perform discovery when this node is started:
# The default list of hosts is ["127.0.0.1", "[::1]"]
#
discovery.seed_hosts: ["elastic1", "elastic2", "elastic3"]
#
# Bootstrap the cluster using an initial set of master-eligible nodes:
#
cluster.initial_master_nodes: ["elastic1", "elastic2"]
#
# For more information, consult the discovery and cluster formation module documentation.
#
# ---------------------------------- Gateway -----------------------------------
#
# Block initial recovery after a full cluster restart until N nodes are started:
# gateway.recover_after_nodes: 3
## For more information, consult the gateway module documentation.
#
# ---------------------------------- Various -----------------------------------
#
# Require explicit names when deleting indices:
#
#action.destructive_requires_name: true

# ENABLES SEC. - autogens an elastic user password
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: elastic-certificates.p12
xpack.license.self_generated.type: basic

Ext Host:

# ---------------------------------- Network ----------------------------------- 
#
# Set the bind address to a specific IP (IPv4 or IPv6):
#
network.host: 0.0.0.0
#
# Set a custom port for HTTP:
#
http.port: 9200
#
## bind for main cluster
transport.profiles.default.port: 9300
transport.profiles.default.bind_host: 0.0.0.0
transport.profiles.default.publish_host: xx.xx.xx.xx

#transport for local 
transport.profiles.dc.port: 9301
transport.profiles.dc.bind_host: 0.0.0.0
transport.profiles.dc.publish_host: xx.xx.xx.xx
# For more information, consult the network module documentation.## --------------------------------- Discovery ---------------------------------- ## Pass an initial list of hosts to perform discovery when this node is started:  
# The default list of hosts is ["127.0.0.1", "[::1]"]
#
discovery.seed_hosts: ["elastic1:9301"]
#
# Bootstrap the cluster using an initial set of master-eligible nodes:
#
cluster.initial_master_nodes: ["elastic1:9301"]
#
# For more information, consult the discovery and cluster formation module documentation.
#
# ---------------------------------- Gateway -----------------------------------
#
# Block initial recovery after a full cluster restart until N nodes are started:
#
#gateway.recover_after_nodes: 3
#
# For more information, consult the gateway module documentation.
#
# ---------------------------------- Various -----------------------------------
#
# Require explicit names when deleting indices:
#
#action.destructive_requires_name: true
# ENABLES SEC. - autogens an elastic user password
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: /etc/elasticsearch/elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: /etc/elasticsearch/elastic-certificates.p12
xpack.license.self_generated.type: basic

each have a copy of the correct cert. verified through /_ssl/certificates