Failed to setup password in APM_SYSTEM in 7.16

How to setup basic + tls security in Elasticsearch
i am following Set up minimal security for Elasticsearch | Elasticsearch Guide [7.16] | Elastic
my elk was in 7.12 with "xpack.security.enabled" to true and discovery zen properties.
after upgrading to 7.16 due to log4j . it throws deprecated discovery parameters
I have replaced discovery.zen* with discovery.seed_hosts & cluster.initial_master_nodes master nodes
and but not able to access kibana .

i tried to setup from initial but could not succeed

  1. xpack.security.enabled= true and elk not starting
    saying "xpack.security.transport.ssl.enabled: true" to be set.
  2. set both xpack.security.transport.ssl.enabled: true & xpack.security.enabled= true
    tried setup passwords as per basic security.
    a. got " fail to setup password on [apm_system]
    b. while trying _cat/health , got "missing credentials"

what is missing here

is there anybody to help on this