SSL certificate problem: unable to get local issuer certificate – Elasticsearch connection in Sulu

Problem Context

Sulu relies on Symfony’s HttpClient, wrapped by the Elastica library, to talk to Elasticsearch. When the Elasticsearch endpoint is HTTPS and presents a self‑signed or otherwise untrusted certificate, the client throws a TransportExceptionInterface with the message SSL certificate problem: unable to get local issuer certificate.

Configuration Gap

The Sulu elasticsearch.yaml file only exposes host, port, index, and authentication settings; it does not provide a way to pass SSL context options such as verify or a custom CA bundle. Consequently, the default system CA store is used, and any certificate not signed by a known authority triggers the error.

Unresolved Decision

Developers must decide how to handle SSL verification for Elasticsearch: add the certificate to the system store, supply a custom CA file, or disable verification entirely (which weakens security). The documentation does not clarify whether future Sulu releases will allow configuring these options.

Specific Questions

1. Does Sulu provide a configuration key to specify a custom CA bundle for the Elasticsearch connection?
2. Can SSL verification be toggled on or off via a Sulu setting, or is patching required?
3. What is the safest recommended approach to avoid the SSL certificate error without exposing the system to man‑in‑the‑middle attacks?