Looking at the code I think it is expecting a PKCS#7 format for the ca_file, but your configuration does not set ca_file on the elasticsearch filter so I am not sure why it is going through that code at all.
I do not think that file can be password protected. It should not contain the private key.