If xpack.security. enabled: false in elasticsearch.yml, then there would be no display of warning message of "a secured connection is required for log in" on browser with http://kibana-hostname:5601 when I set server.ssl.enabled:false and elasticsearch.url: "http://el.node.cn:9200" in kibana.yml.
I guess that the warning message of "a secured connection is required for log in" is for the security of user name and password input via browser, which is only required when xpack.security. enabled: true in elasticsearch.yml. So I don't think it has nothing to do with elasticsearch security settings, though the secured connection between elasticsearch node and kibana node is not dependent on server.ssl settings in kibana.yml.