Howto get the elastic apt install to work with SuiteCRM:
To get SuiteCRM working with security enabled (xpack.security.enabled: true) in elastic, I did the following:
Copy self signed elastic cert to /usr/local/share/ca-certificates/
cp /etc/elasticsearch/certs/http_ca.crt /usr/local/share/ca-certificates/elastic.crt
Then I added it to ca-certificates, so php/curl would trust it, and SuitCRM would connect via user/password in the GUI.
update-ca-certificates

I feel this should be in the documentation for a security aware install via apt.