@Test
    public void testElasticsearch8SecureByDefaultCustomCaCertFails() throws Exception {
        final MountableFile mountableFile = MountableFile.forClasspathResource("http_ca.crt");
        String caPath = "/tmp/http_ca.crt";
        try (
            ElasticsearchContainer container = new ElasticsearchContainer(
                "docker.elastic.co/elasticsearch/elasticsearch:8.1.2"
            )
                .withCopyToContainer(mountableFile, caPath)
                .withCertPath(caPath)
        ) {
            container.start();

            // this is expected, as a different cert is used for creating the SSL context
            assertThat(catchThrowable(() -> getClusterHealth(container)))
                .as(
                    "PKIX path validation failed: java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors"
                )
                .isInstanceOf(SSLHandshakeException.class);
        }
    }
From 6.8, we can optionally activate security with a default password.
modules/elasticsearch/src/test/java/org/testcontainers/elasticsearch/ElasticsearchContainerTest.java