As opposed to a security policy of Elasticsearch, client including brower, bash or process(java, python, etc) should use https. I agree with your opinion that it’s a burden to manage CA certificates, but there’s no way to make Transport layer not to use TLS. I just recommend you using cert-manager for configuring secrets of certificates(admin-cert, transport-cert, and http-cert if you need).
ref: Securityadmin error when initializing the cluster - #2 by yeonghyeonKo