@epheria , @elasticscrub it seems this is just a docs error in
curl --cacert /etc/elasticsearch/config/certs/http_ca.crt -u elastic https://localhost:9200
should be
curl --cacert /etc/elasticsearch/certs/http_ca.crt -u elastic https://localhost:9200
Apologies for missing this above. We will adjust the docs, thanks for bringing this up !