During desired nodes updates the system validates that the provided node settings are valid in order to avoid boot looping issues. If one of the node settings depends on a secure setting, the validation fails even when the secure setting is present and correct.
server/src/main/java/org/elasticsearch/node/Node.java
if (logger.isTraceEnabled()) {
            toClose.add(() -> logger.trace("Close times for each service:\n{}", stopWatch.prettyPrint()));
        }
        IOUtils.close(toClose);
        logger.info("closed");
    }
    /**
     * Invokes hooks to prepare this node to be closed. This should be called when Elasticsearch receives a request to shut down
     * gracefully from the underlying operating system, before system resources are closed. This method will block
     * until the node is ready to shut down.
     *
     * Note that this class is part of infrastructure to react to signals from the operating system - most graceful shutdown
     * logic should use Node Shutdown, see {@link org.elasticsearch.cluster.metadata.NodesShutdownMetadata}.
     */
    public void prepareForClose() {
        HttpServerTransport httpServerTransport = injector.getInstance(HttpServerTransport.class);
        FutureTask<Void> stopper = new FutureTask<>(() -> {
            httpServerTransport.stop();
            return null;
        });
        new Thread(stopper, "http-server-transport-stop").start();
        Optional.ofNullable(terminationHandler.get()).ifPresent(TerminationHandler::handleTermination);
        try {
            stopper.get();
        } catch (Exception e) {
            logger.warn("unexpected exception while waiting for http server to close", e);
        }
    }
    /**
     * Wait for this node to be effectively closed.