diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
index cbf5f06a89f..05e6c50c4fd 100644
--- a/CHANGELOG.next.asciidoc
+++ b/CHANGELOG.next.asciidoc
@@ -43,6 +43,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Disable the option of running --machine-learning on its own. {pull}20241[20241]
 - Fix PANW field spelling "veredict" to "verdict" on event.action {pull}18808[18808]
 - Add support for GMT timezone offsets in `decode_cef`. {pull}20993[20993]
+- Fix initialization of http client in Cloudfoundry input. {issue}28271[28271] {pull}28277[28277]
 
 *Heartbeat*
 
diff --git a/x-pack/libbeat/common/cloudfoundry/dopplerconsumer.go b/x-pack/libbeat/common/cloudfoundry/dopplerconsumer.go
index 96349eeb7ea..bd00d424953 100644
--- a/x-pack/libbeat/common/cloudfoundry/dopplerconsumer.go
+++ b/x-pack/libbeat/common/cloudfoundry/dopplerconsumer.go
@@ -5,8 +5,9 @@
 package cloudfoundry
 
 import (
-	"fmt"
+	"crypto/tls"
 	"net/http"
+	"net/url"
 	"regexp"
 	"sync"
 
@@ -37,13 +38,8 @@ type DopplerConsumer struct {
 	started bool
 }
 
-func newDopplerConsumer(address string, id string, log *logp.Logger, client *http.Client, tr *TokenRefresher, callbacks DopplerCallbacks) (*DopplerConsumer, error) {
-	transport, ok := client.Transport.(*http.Transport)
-	if !ok {
-		return nil, fmt.Errorf("expected http transport on client")
-	}
-
-	c := consumer.New(address, transport.TLSClientConfig, transport.Proxy)
+func newDopplerConsumer(address string, id string, log *logp.Logger, tlsConfig *tls.Config, proxy func(*http.Request) (*url.URL, error), tr *TokenRefresher, callbacks DopplerCallbacks) (*DopplerConsumer, error) {
+	c := consumer.New(address, tlsConfig, proxy)
 	c.RefreshTokenFrom(tr)
 	c.SetDebugPrinter(newLogpDebugPrinter(log))
 
diff --git a/x-pack/libbeat/common/cloudfoundry/hub.go b/x-pack/libbeat/common/cloudfoundry/hub.go
index 9bcf929ded2..42bc786f550 100644
--- a/x-pack/libbeat/common/cloudfoundry/hub.go
+++ b/x-pack/libbeat/common/cloudfoundry/hub.go
@@ -129,13 +129,14 @@ func (h *Hub) DopplerConsumerFromClient(client *cfclient.Client, callbacks Doppl
 	if dopplerAddress == "" {
 		dopplerAddress = client.Endpoint.DopplerEndpoint
 	}
-	httpClient, _, err := h.httpClient()
+	tlsConfig, err := tlscommon.LoadTLSConfig(h.cfg.Transport.TLS)
 	if err != nil {
-		return nil, errors.Wrap(err, "getting http client")
+		return nil, errors.Wrap(err, "loading tls config")
 	}
+	proxy := h.cfg.Transport.Proxy.ProxyFunc()
 
 	tr := TokenRefresherFromCfClient(client)
-	return newDopplerConsumer(dopplerAddress, h.cfg.ShardID, h.log, httpClient, tr, callbacks)
+	return newDopplerConsumer(dopplerAddress, h.cfg.ShardID, h.log, tlsConfig.ToConfig(), proxy, tr, callbacks)
 }
 
 // doerFromClient returns an auth token doer using uaa.