Chef Client Upgrade 16 => 17 Kitchen Converge Failure SSL Verification - ssl

Question

Business is working on upgrading chef client throughout the orgs from 16 to 17 (17.9.26 specifically). Within our cookbooks we perform a chef http_request to test the availability of the resource within Test Kitchen/elsewhere and validate the ssl certificate. With the client upgrade we started to see a SSL verification failure indicating the CA-bundle that we're dropping out there cannot be validated. Pretty weird since nothing changed in the source for this except that we're now on client version 17 instead of 16. If I go out to the node that is built via test kitchen (we deploy test instances to AWS ec2 instances) and attempt to curl localhost (should be about the same thing as the chef http_request I guess) it will fail, but then if I specify the ca-bundle that Chef should be using by default the curl returns correct response.
`
[root#ip-REDACTED ~]# curl https://localhost:9200
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html
curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
[root#ip-REDACTED ~]# curl https://localhost:9200 --cacert /opt/chef/embedded/ssl/certs/cacert.pem
{
"name" : "ip-REDACTED",
"cluster_name" : "REDACTED-unit-green",
"clusEDACTEDter_uuid" : "R",
"version" : {
"number" : "6.4.3",
"build_flavor" : "default",
"build_type" : "rpm",
"build_hash" : "fe40335",
"build_date" : "2018-10-30T23:17:19.084789Z",
"build_snapshot" : false,
"lucene_version" : "7.4.0",
"minimum_wire_compatibility_version" : "5.6.0",
"minimum_index_compatibility_version" : "5.0.0"
},
"tagline" : "You Know, for Search"
}
[root#ip-REDACTED ~]#
`
I can't really provide all of my cookbooks/recipes, but according to: https://docs.chef.io/chef_client_security/ the location of that ca-bundle file is correct and as mentioned and shown in the above snip it validates fine when specified. It also ran through kitchen correctly before switching client versions. Really just out here hoping that someone might have experienced similar and knows what they did to fix it.
Thanks in advance, and if I've been unclear about anything just let me know in the comments, I will try to clarify.
EDIT: Forgot to include the actual exception that comes from Chef test kitchen run:
`
================================================================================
Error executing action `put` on resource 'http_request[elasticsearch_license]'
================================================================================
OpenSSL::SSL::SSLError
----------------------
SSL Error connecting to https://localhost:9200/_xpack/license - SSL_connect returned=1 errno=0 state=error: certificate verify failed (unable to get local issuer certificate)
Resource Declaration:
---------------------
# In /tmp/kitchen/cache/cookbooks/csg_stathub_linux_643/recipes/register_license.rb
31: http_request 'elasticsearch_license' do
32: url "#{node['REDACTED']['es']['endpoint']['local_api']}/_xpack/license"
33: action :nothing
34: message lazy { ::File.read("/etc/elasticsearch/#{license_file}") }
35: provider Chef::Provider::HttpRequest
36: retries 10
37: retry_delay 5
38: headers({ 'Authorization' => "Basic #{elastic_userpass64}", 'Content-Type' => 'application/json' })
39: subscribes :put, 'http_request[elasticsearch_cluster_health]', :immediately
40: only_if { ::File.exist?("/etc/elasticsearch/#{license_file}") }
41: only_if { elasticsearch_service_running? }
42: end
43:
`