diff --git a/modules/reindex/src/main/plugin-metadata/entitlement-policy.yaml b/modules/reindex/src/main/plugin-metadata/entitlement-policy.yaml
index d1e8d1aca74dd..64352bc2476fe 100644
--- a/modules/reindex/src/main/plugin-metadata/entitlement-policy.yaml
+++ b/modules/reindex/src/main/plugin-metadata/entitlement-policy.yaml
@@ -1,7 +1,24 @@
 ALL-UNNAMED:
   - manage_threads
   - outbound_network
+  - create_class_loader # needed for Painless to generate runtime classes
   - files:
+      # TODO: review and possibly remove this general permission
       - relative_path: ""
         relative_to: config
         mode: read
+      - path_setting: "reindex.ssl.certificate"
+        basedir_if_relative: config
+        mode: read
+      - path_setting: "reindex.ssl.key"
+        basedir_if_relative: config
+        mode: read
+      - path_setting: "reindex.ssl.keystore.path"
+        basedir_if_relative: config
+        mode: read
+      - path_setting: "reindex.ssl.certificate_authorities"
+        basedir_if_relative: config
+        mode: read
+      - path_setting: "reindex.ssl.truststore.path"
+        basedir_if_relative: config
+        mode: read