PKI isn't well supported in 5.x. You may be running into an issue where the default username/password get sent to ES even when they're not defined in kibana.yml. I believe this should be fixed in 6.0. beta1 just shipped, so you could test it out if you like.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.