public Optional<byte[]> caCertAsBytes() {
        if (StringUtils.isBlank(certPath)) {
            return Optional.empty();
        }
        try {
            byte[] bytes = copyFileFromContainer(certPath, IOUtils::toByteArray);
            if (bytes.length > 0) {
                return Optional.of(bytes);
            }
        } catch (NotFoundException e) {
            // just emit an error message, but do not throw an exception
            // this might be ok, if the docker image is accidentally looking like version 8 or latest
            // can happen if Elasticsearch is repackaged, i.e. with custom plugins
            log.warn("CA cert under " + certPath + " not found.");
        }
        return Optional.empty();
    }
If this is running above Elasticsearch 8, this will return the probably self-signed CA cert that has been extracted

@return byte array optional containing the CA cert extracted from the docker container
modules/elasticsearch/src/main/java/org/testcontainers/elasticsearch/ElasticsearchContainer.java