diff --git a/qa/os/src/test/java/org/elasticsearch/packaging/test/ArchiveGenerateInitialCredentialsTests.java b/qa/os/src/test/java/org/elasticsearch/packaging/test/ArchiveGenerateInitialCredentialsTests.java
index b01662caf55f4..c0fb264634712 100644
--- a/qa/os/src/test/java/org/elasticsearch/packaging/test/ArchiveGenerateInitialCredentialsTests.java
+++ b/qa/os/src/test/java/org/elasticsearch/packaging/test/ArchiveGenerateInitialCredentialsTests.java
@@ -8,7 +8,6 @@
 
 package org.elasticsearch.packaging.test;
 
-import org.apache.http.client.fluent.Request;
 import org.elasticsearch.packaging.util.Distribution;
 import org.elasticsearch.packaging.util.FileUtils;
 import org.elasticsearch.packaging.util.ServerUtils;
@@ -83,12 +82,7 @@ public void test40VerifyAutogeneratedCredentials() throws Exception {
         assertThat(parseElasticPassword(result.stdout), notNullValue());
         assertThat(parseKibanaToken(result.stdout), notNullValue());
         assertThat(parseFingerprint(result.stdout), notNullValue());
-        String response = ServerUtils.makeRequest(
-            Request.Get("https://localhost:9200"),
-            "elastic",
-            parseElasticPassword(result.stdout),
-            ServerUtils.getCaCert(installation)
-        );
+        String response = makeRequestAsElastic("https://localhost:9200", parseElasticPassword(result.stdout));
         assertThat(response, containsString("You Know, for Search"));
     }
 
diff --git a/qa/os/src/test/java/org/elasticsearch/packaging/test/ArchiveTests.java b/qa/os/src/test/java/org/elasticsearch/packaging/test/ArchiveTests.java
index 6894db2558a3b..2708e4bc480c8 100644
--- a/qa/os/src/test/java/org/elasticsearch/packaging/test/ArchiveTests.java
+++ b/qa/os/src/test/java/org/elasticsearch/packaging/test/ArchiveTests.java
@@ -36,7 +36,6 @@
 import static org.elasticsearch.packaging.util.FileUtils.append;
 import static org.elasticsearch.packaging.util.FileUtils.mv;
 import static org.elasticsearch.packaging.util.FileUtils.rm;
-import static org.elasticsearch.packaging.util.ServerUtils.makeRequest;
 import static org.hamcrest.CoreMatchers.containsString;
 import static org.hamcrest.CoreMatchers.equalTo;
 import static org.hamcrest.CoreMatchers.is;
@@ -53,16 +52,10 @@ public static void filterDistros() {
         assumeTrue("only archives", distribution.isArchive());
     }
 
-    private static String superuser = "test_superuser";
-    private static String superuserPassword = "test_superuser";
-
     public void test10Install() throws Exception {
         installation = installArchive(sh, distribution());
         verifyArchiveInstallation(installation, distribution());
-        Result result = sh.run(
-            installation.executables().usersTool + " useradd " + superuser + " -p " + superuserPassword + " -r " + "superuser"
-        );
-        assumeTrue(result.isSuccess());
+        setFileSuperuser("test_superuser", "test_superuser_password");
         // See https://bugs.openjdk.java.net/browse/JDK-8267701. In short, when generating PKCS#12 keystores in JDK 12 and later
         // the MAC algorithm used for integrity protection is incompatible with any previous JDK version. This affects us as we generate
         // PKCS12 keystores on startup ( with the bundled JDK ) but we also need to run certain tests with a JDK other than the bundled
@@ -208,7 +201,7 @@ public void test44AutoConfigurationNotTriggeredOnNotWriteableConfDir() throws Ex
             startElasticsearch();
             verifySecurityNotAutoConfigured(installation);
             // the node still starts, with Security enabled, but without TLS auto-configured (so only authentication)
-            ServerUtils.runElasticsearchTests(superuser, superuserPassword, null);
+            runElasticsearchTests();
             stopElasticsearch();
         } finally {
             Platforms.onWindows(() -> {
@@ -294,10 +287,8 @@ public void test52AutoConfigurationOnWindows() throws Exception {
 
     public void test60StartAndStop() throws Exception {
         startElasticsearch();
-
         assertThat(installation.logs.resolve("gc.log"), fileExists());
-        ServerUtils.runElasticsearchTests(superuser, superuserPassword, ServerUtils.getCaCert(installation));
-
+        runElasticsearchTests();
         stopElasticsearch();
     }
 
@@ -312,7 +303,7 @@ public void test61EsJavaHomeOverride() throws Exception {
         });
 
         startElasticsearch();
-        ServerUtils.runElasticsearchTests(superuser, superuserPassword, ServerUtils.getCaCert(installation));
+        runElasticsearchTests();
         stopElasticsearch();
 
         String systemJavaHome1 = sh.getEnv().get("ES_JAVA_HOME");
@@ -339,7 +330,7 @@ public void test62JavaHomeIgnored() throws Exception {
         assertThat(runResult.stderr, containsString("warning: ignoring JAVA_HOME=" + systemJavaHome + "; using bundled JDK"));
 
         startElasticsearch();
-        ServerUtils.runElasticsearchTests(superuser, superuserPassword, ServerUtils.getCaCert(installation));
+        runElasticsearchTests();
         stopElasticsearch();
 
         // if the JDK started with the bundled JDK then we know that JAVA_HOME was ignored
@@ -363,7 +354,7 @@ public void test63BundledJdkRemoved() throws Exception {
             });
 
             startElasticsearch();
-            ServerUtils.runElasticsearchTests(superuser, superuserPassword, ServerUtils.getCaCert(installation));
+            runElasticsearchTests();
             stopElasticsearch();
 
             String systemJavaHome1 = sh.getEnv().get("ES_JAVA_HOME");
@@ -384,7 +375,7 @@ public void test64JavaHomeWithSpecialCharacters() throws Exception {
 
                 // verify ES can start, stop and run plugin list
                 startElasticsearch();
-                ServerUtils.runElasticsearchTests(superuser, superuserPassword, ServerUtils.getCaCert(installation));
+                runElasticsearchTests();
                 stopElasticsearch();
 
                 String pluginListCommand = installation.bin + "/elasticsearch-plugin list";
@@ -409,7 +400,7 @@ public void test64JavaHomeWithSpecialCharacters() throws Exception {
 
                 // verify ES can start, stop and run plugin list
                 startElasticsearch();
-                ServerUtils.runElasticsearchTests(superuser, superuserPassword, ServerUtils.getCaCert(installation));
+                runElasticsearchTests();
                 stopElasticsearch();
 
                 String pluginListCommand = installation.bin + "/elasticsearch-plugin list";
@@ -427,7 +418,7 @@ public void test65ForceBundledJdkEmptyJavaHome() throws Exception {
         sh.getEnv().put("ES_JAVA_HOME", "");
 
         startElasticsearch();
-        ServerUtils.runElasticsearchTests(superuser, superuserPassword, ServerUtils.getCaCert(installation));
+        runElasticsearchTests();
         stopElasticsearch();
     }
 
@@ -439,7 +430,7 @@ public void test65ForceBundledJdkEmptyJavaHome() throws Exception {
     public void test66InstallUnderPosix() throws Exception {
         sh.getEnv().put("POSIXLY_CORRECT", "1");
         startElasticsearch();
-        ServerUtils.runElasticsearchTests(superuser, superuserPassword, ServerUtils.getCaCert(installation));
+        runElasticsearchTests();
         stopElasticsearch();
     }
 
@@ -452,11 +443,11 @@ public void test70CustomPathConfAndJvmOptions() throws Exception {
             sh.getEnv().put("ES_JAVA_OPTS", "-XX:-UseCompressedOops");
             startElasticsearch();
 
-            final String nodesResponse = makeRequest(
+            final String nodesResponse = ServerUtils.makeRequest(
                 Request.Get("https://localhost:9200/_nodes"),
-                superuser,
-                superuserPassword,
-                ServerUtils.getCaCert(installation)
+                "test_superuser",
+                "test_superuser_password",
+                ServerUtils.getCaCert(tempConf)
             );
             assertThat(nodesResponse, containsString("\"heap_init_in_bytes\":536870912"));
             assertThat(nodesResponse, containsString("\"using_compressed_ordinary_object_pointers\":\"false\""));
@@ -473,12 +464,7 @@ public void test71CustomJvmOptionsDirectoryFile() throws Exception {
 
             startElasticsearch();
 
-            final String nodesResponse = makeRequest(
-                Request.Get("https://localhost:9200/_nodes"),
-                superuser,
-                superuserPassword,
-                ServerUtils.getCaCert(installation)
-            );
+            final String nodesResponse = makeRequest("https://localhost:9200/_nodes");
             assertThat(nodesResponse, containsString("\"heap_init_in_bytes\":536870912"));
 
             stopElasticsearch();
@@ -501,12 +487,7 @@ public void test72CustomJvmOptionsDirectoryFilesAreProcessedInSortedOrder() thro
 
             startElasticsearch();
 
-            final String nodesResponse = makeRequest(
-                Request.Get("https://localhost:9200/_nodes"),
-                superuser,
-                superuserPassword,
-                ServerUtils.getCaCert(installation)
-            );
+            final String nodesResponse = makeRequest("https://localhost:9200/_nodes");
             assertThat(nodesResponse, containsString("\"heap_init_in_bytes\":536870912"));
             assertThat(nodesResponse, containsString("\"using_compressed_ordinary_object_pointers\":\"false\""));
 
@@ -523,7 +504,7 @@ public void test73CustomJvmOptionsDirectoryFilesWithoutOptionsExtensionIgnored()
             append(jvmOptionsIgnored, "-Xthis_is_not_a_valid_option\n");
 
             startElasticsearch();
-            ServerUtils.runElasticsearchTests(superuser, superuserPassword, ServerUtils.getCaCert(installation));
+            runElasticsearchTests();
             stopElasticsearch();
         } finally {
             rm(jvmOptionsIgnored);
@@ -535,12 +516,7 @@ public void test80RelativePathConf() throws Exception {
             append(tempConf.resolve("elasticsearch.yml"), "node.name: relative");
             startElasticsearch();
 
-            final String nodesResponse = makeRequest(
-                Request.Get("https://localhost:9200/_nodes"),
-                superuser,
-                superuserPassword,
-                ServerUtils.getCaCert(installation)
-            );
+            final String nodesResponse = makeRequest("https://localhost:9200/_nodes");
             assertThat(nodesResponse, containsString("\"name\":\"relative\""));
 
             stopElasticsearch();
diff --git a/qa/os/src/test/java/org/elasticsearch/packaging/test/ConfigurationTests.java b/qa/os/src/test/java/org/elasticsearch/packaging/test/ConfigurationTests.java
index 563e80ab9b57d..91ba054bf3dcc 100644
--- a/qa/os/src/test/java/org/elasticsearch/packaging/test/ConfigurationTests.java
+++ b/qa/os/src/test/java/org/elasticsearch/packaging/test/ConfigurationTests.java
@@ -12,20 +12,14 @@
 import org.elasticsearch.packaging.util.FileUtils;
 import org.elasticsearch.packaging.util.Platforms;
 import org.elasticsearch.packaging.util.ServerUtils;
-import org.elasticsearch.packaging.util.Shell;
 import org.junit.Before;
 
 import static org.elasticsearch.packaging.util.FileUtils.append;
-import static org.elasticsearch.packaging.util.ServerUtils.makeRequest;
 import static org.hamcrest.Matchers.equalTo;
-import static org.hamcrest.Matchers.is;
 import static org.junit.Assume.assumeFalse;
 
 public class ConfigurationTests extends PackagingTestCase {
 
-    private static String superuser = "test_superuser";
-    private static String superuserPassword = "test_superuser";
-
     @Before
     public void filterDistros() {
         assumeFalse("no docker", distribution.isDocker());
@@ -33,10 +27,7 @@ public void filterDistros() {
 
     public void test10Install() throws Exception {
         install();
-        Shell.Result result = sh.run(
-            installation.executables().usersTool + " useradd " + superuser + " -p " + superuserPassword + " -r " + "superuser"
-        );
-        assertThat(result.isSuccess(), is(true));
+        setFileSuperuser("test_superuser", "test_superuser_password");
     }
 
     public void test20HostnameSubstitution() throws Exception {
@@ -53,10 +44,10 @@ public void test20HostnameSubstitution() throws Exception {
             // security auto-config requires that the archive owner and the node process user be the same
             Platforms.onWindows(() -> sh.chown(confPath, installation.getOwner()));
             assertWhileRunning(() -> {
-                final String nameResponse = makeRequest(
+                final String nameResponse = ServerUtils.makeRequest(
                     Request.Get(protocol + "://localhost:9200/_cat/nodes?h=name"),
-                    superuser,
-                    superuserPassword,
+                    "test_superuser",
+                    "test_superuser_password",
                     ServerUtils.getCaCert(confPath)
                 ).strip();
                 assertThat(nameResponse, equalTo("mytesthost"));
diff --git a/qa/os/src/test/java/org/elasticsearch/packaging/test/DockerTests.java b/qa/os/src/test/java/org/elasticsearch/packaging/test/DockerTests.java
index 2bce734fe2b5c..6ef7a700e8ff2 100644
--- a/qa/os/src/test/java/org/elasticsearch/packaging/test/DockerTests.java
+++ b/qa/os/src/test/java/org/elasticsearch/packaging/test/DockerTests.java
@@ -93,7 +93,6 @@
  */
 public class DockerTests extends PackagingTestCase {
     private Path tempDir;
-    private static final String USERNAME = "elastic";
     private static final String PASSWORD = "nothunter2";
 
     @BeforeClass
@@ -125,13 +124,8 @@ public void test010Install() throws Exception {
      * Check that security is enabled
      */
     public void test011SecurityEnabledStatus() throws Exception {
-        waitForElasticsearch(installation, USERNAME, PASSWORD);
-        final int statusCode = ServerUtils.makeRequestAndGetStatus(
-            Request.Get("https://localhost:9200"),
-            USERNAME,
-            "wrong_password",
-            ServerUtils.getCaCert(installation)
-        );
+        waitForElasticsearch(installation, "elastic", PASSWORD);
+        final int statusCode = makeRequestAsElastic("wrong_password");
         assertThat(statusCode, equalTo(401));
     }
 
@@ -226,7 +220,7 @@ public void test041AmazonCaCertsAreInTheKeystore() {
      * Check that when the keystore is created on startup, it is created with the correct permissions.
      */
     public void test042KeystorePermissionsAreCorrect() {
-        waitForElasticsearch(installation, USERNAME, PASSWORD);
+        waitForElasticsearch(installation, "elastic", PASSWORD);
 
         assertThat(installation.config("elasticsearch.keystore"), file(p660));
     }
@@ -236,11 +230,11 @@ public void test042KeystorePermissionsAreCorrect() {
      * is minimally functional.
      */
     public void test050BasicApiTests() throws Exception {
-        waitForElasticsearch(installation, USERNAME, PASSWORD);
+        waitForElasticsearch(installation, "elastic", PASSWORD);
 
         assertTrue(existsInContainer(installation.logs.resolve("gc.log")));
 
-        ServerUtils.runElasticsearchTests(USERNAME, PASSWORD, ServerUtils.getCaCert(installation));
+        runElasticsearchTestsAsElastic(PASSWORD);
     }
 
     /**
@@ -276,9 +270,9 @@ public void test070BindMountCustomPathConfAndJvmOptions() throws Exception {
                 .envVar("ELASTIC_PASSWORD", PASSWORD)
         );
 
-        waitForElasticsearch(installation, USERNAME, PASSWORD);
+        waitForElasticsearch(installation, "elastic", PASSWORD);
 
-        final JsonNode nodes = getJson("/_nodes", USERNAME, PASSWORD, ServerUtils.getCaCert(installation)).get("nodes");
+        final JsonNode nodes = getJson("/_nodes", "elastic", PASSWORD, ServerUtils.getCaCert(installation)).get("nodes");
         final String nodeId = nodes.fieldNames().next();
 
         final int heapSize = nodes.at("/" + nodeId + "/jvm/mem/heap_init_in_bytes").intValue();
@@ -304,9 +298,9 @@ public void test071BindMountCustomPathWithDifferentUID() throws Exception {
                 distribution(),
                 builder().volume(tempEsDataDir.toAbsolutePath(), installation.data).envVar("ELASTIC_PASSWORD", PASSWORD)
             );
-            waitForElasticsearch(installation, USERNAME, PASSWORD);
+            waitForElasticsearch(installation, "elastic", PASSWORD);
 
-            final JsonNode nodes = getJson("/_nodes", USERNAME, PASSWORD, ServerUtils.getCaCert(installation));
+            final JsonNode nodes = getJson("/_nodes", "elastic", PASSWORD, ServerUtils.getCaCert(installation));
 
             assertThat(nodes.at("/_nodes/total").intValue(), equalTo(1));
             assertThat(nodes.at("/_nodes/successful").intValue(), equalTo(1));
@@ -360,7 +354,7 @@ public void test072RunEsAsDifferentUserAndGroup() throws Exception {
                 .volume(tempEsLogsDir.toAbsolutePath(), installation.logs)
         );
 
-        waitForElasticsearch(installation, USERNAME, PASSWORD);
+        waitForElasticsearch(installation, "elastic", PASSWORD);
         rmDirWithPrivilegeEscalation(tempEsConfigDir);
         rmDirWithPrivilegeEscalation(tempEsDataDir);
         rmDirWithPrivilegeEscalation(tempEsLogsDir);
@@ -374,7 +368,7 @@ public void test073RunEsAsDifferentUserAndGroupWithoutBindMounting() {
         // Restart the container
         runContainer(distribution(), builder().extraArgs("--group-add 0").uid(501, 501).envVar("ELASTIC_PASSWORD", PASSWORD));
 
-        waitForElasticsearch(installation, USERNAME, PASSWORD);
+        waitForElasticsearch(installation, "elastic", PASSWORD);
     }
 
     /**
@@ -778,7 +772,7 @@ public void test110OrgOpencontainersLabels() throws Exception {
      * Check that the container logs contain the expected content for Elasticsearch itself.
      */
     public void test120DockerLogsIncludeElasticsearchLogs() {
-        waitForElasticsearch(installation, USERNAME, PASSWORD);
+        waitForElasticsearch(installation, "elastic", PASSWORD);
         final Result containerLogs = getContainerLogs();
 
         assertThat("Container logs should contain full class names", containerLogs.stdout, containsString("org.elasticsearch.node.Node"));
@@ -791,7 +785,7 @@ public void test120DockerLogsIncludeElasticsearchLogs() {
     public void test121CanUseStackLoggingConfig() {
         runContainer(distribution(), builder().envVar("ES_LOG_STYLE", "file").envVar("ELASTIC_PASSWORD", PASSWORD));
 
-        waitForElasticsearch(installation, USERNAME, PASSWORD);
+        waitForElasticsearch(installation, "elastic", PASSWORD);
 
         final Result containerLogs = getContainerLogs();
         final List<String> stdout = containerLogs.stdout.lines().collect(Collectors.toList());
@@ -806,7 +800,7 @@ public void test121CanUseStackLoggingConfig() {
     public void test122CanUseDockerLoggingConfig() {
         runContainer(distribution(), builder().envVar("ES_LOG_STYLE", "console").envVar("ELASTIC_PASSWORD", PASSWORD));
 
-        waitForElasticsearch(installation, USERNAME, PASSWORD);
+        waitForElasticsearch(installation, "elastic", PASSWORD);
 
         final Result containerLogs = getContainerLogs();
         final List<String> stdout = containerLogs.stdout.lines().collect(Collectors.toList());
@@ -830,12 +824,12 @@ public void test123CannotUseUnknownLoggingConfig() {
     public void test124CanRestartContainerWithStackLoggingConfig() {
         runContainer(distribution(), builder().envVar("ES_LOG_STYLE", "file").envVar("ELASTIC_PASSWORD", PASSWORD));
 
-        waitForElasticsearch(installation, USERNAME, PASSWORD);
+        waitForElasticsearch(installation, "elastic", PASSWORD);
 
         restartContainer();
 
         // If something went wrong running Elasticsearch the second time, this will fail.
-        waitForElasticsearch(installation, USERNAME, PASSWORD);
+        waitForElasticsearch(installation, "elastic", PASSWORD);
     }
 
     /**
@@ -871,9 +865,9 @@ public void test131InitProcessHasCorrectPID() {
      * Check that Elasticsearch reports per-node cgroup information.
      */
     public void test140CgroupOsStatsAreAvailable() throws Exception {
-        waitForElasticsearch(installation, USERNAME, PASSWORD);
+        waitForElasticsearch(installation, "elastic", PASSWORD);
 
-        final JsonNode nodes = getJson("/_nodes/stats/os", USERNAME, PASSWORD, ServerUtils.getCaCert(installation)).get("nodes");
+        final JsonNode nodes = getJson("/_nodes/stats/os", "elastic", PASSWORD, ServerUtils.getCaCert(installation)).get("nodes");
 
         final String nodeId = nodes.fieldNames().next();
 
@@ -907,7 +901,7 @@ public void test150MachineDependentHeap() throws Exception {
             builder().memory("942m").volume(jvmOptionsPath, containerJvmOptionsPath).envVar("ELASTIC_PASSWORD", PASSWORD)
         );
 
-        waitForElasticsearch(installation, USERNAME, PASSWORD);
+        waitForElasticsearch(installation, "elastic", PASSWORD);
 
         // Grab the container output and find the line where it print the JVM arguments. This will
         // let us see what the automatic heap sizing calculated.
diff --git a/qa/os/src/test/java/org/elasticsearch/packaging/test/KeystoreManagementTests.java b/qa/os/src/test/java/org/elasticsearch/packaging/test/KeystoreManagementTests.java
index fd644e48b0634..cef55bbcb37d9 100644
--- a/qa/os/src/test/java/org/elasticsearch/packaging/test/KeystoreManagementTests.java
+++ b/qa/os/src/test/java/org/elasticsearch/packaging/test/KeystoreManagementTests.java
@@ -55,8 +55,7 @@ public class KeystoreManagementTests extends PackagingTestCase {
     public static final String ERROR_CORRUPTED_KEYSTORE = "Keystore has been corrupted or tampered with";
     public static final String ERROR_KEYSTORE_NOT_PASSWORD_PROTECTED = "ERROR: Keystore is not password-protected";
     public static final String ERROR_KEYSTORE_NOT_FOUND = "ERROR: Elasticsearch keystore not found";
-    private static final String USERNAME = "elastic";
-    private static final String PASSWORD = "nothunter2";
+    private static final String ELASTIC_PASSWORD = "nothunter2";
     private static final String FILE_REALM_SUPERUSER = "test-user";
     private static final String FILE_REALM_SUPERUSER_PASSWORD = "test-user-password";
     private static final String KEYSTORE_PASSWORD = "keystore-password";
@@ -69,16 +68,7 @@ public void test10InstallArchiveDistribution() throws Exception {
         verifyArchiveInstallation(installation, distribution());
         // Add a user for tests to use.
         // TODO: Possibly capture autoconfigured password from running the node the first time
-        Shell.Result result = sh.run(
-            installation.executables().usersTool
-                + " useradd "
-                + FILE_REALM_SUPERUSER
-                + " -p "
-                + FILE_REALM_SUPERUSER_PASSWORD
-                + " -r "
-                + "superuser"
-        );
-        assumeTrue(result.isSuccess());
+        setFileSuperuser(FILE_REALM_SUPERUSER, FILE_REALM_SUPERUSER_PASSWORD);
 
         final Installation.Executables bin = installation.executables();
         Shell.Result r = sh.runIgnoreExitCode(bin.keystoreTool + " has-passwd");
@@ -133,7 +123,7 @@ public void test20KeystorePasswordOnStandardInput() throws Exception {
         assertPasswordProtectedKeystore();
 
         awaitElasticsearchStartup(runElasticsearchStartCommand(KEYSTORE_PASSWORD, true, false));
-        ServerUtils.runElasticsearchTests(FILE_REALM_SUPERUSER, FILE_REALM_SUPERUSER_PASSWORD, ServerUtils.getCaCert(installation));
+        runElasticsearchTests();
         stopElasticsearch();
     }
 
@@ -156,7 +146,7 @@ public void test22KeystorePasswordOnTty() throws Exception {
         assertPasswordProtectedKeystore();
 
         awaitElasticsearchStartup(runElasticsearchStartCommand(KEYSTORE_PASSWORD, true, true));
-        ServerUtils.runElasticsearchTests(FILE_REALM_SUPERUSER, FILE_REALM_SUPERUSER_PASSWORD, ServerUtils.getCaCert(installation));
+        runElasticsearchTests();
         stopElasticsearch();
     }
 
@@ -247,10 +237,10 @@ public void test40DockerEnvironmentVariablePassword() throws Exception {
             distribution(),
             builder().volume(localConfigDir.resolve("config"), installation.config)
                 .envVar("KEYSTORE_PASSWORD", KEYSTORE_PASSWORD)
-                .envVar("ELASTIC_PASSWORD", PASSWORD)
+                .envVar("ELASTIC_PASSWORD", ELASTIC_PASSWORD)
         );
-        waitForElasticsearch(installation, USERNAME, PASSWORD);
-        ServerUtils.runElasticsearchTests(USERNAME, PASSWORD, ServerUtils.getCaCert(installation));
+        waitForElasticsearch(installation, "elastic", ELASTIC_PASSWORD);
+        runElasticsearchTestsAsElastic(ELASTIC_PASSWORD);
     }
 
     /**
@@ -277,11 +267,11 @@ public void test41DockerEnvironmentVariablePasswordFromFile() throws Exception {
                 builder().volume(localConfigDir.resolve("config"), installation.config)
                     .volume(tempDir, "/run/secrets")
                     .envVar("KEYSTORE_PASSWORD_FILE", "/run/secrets/" + passwordFilename)
-                    .envVar("ELASTIC_PASSWORD", PASSWORD)
+                    .envVar("ELASTIC_PASSWORD", ELASTIC_PASSWORD)
             );
 
-            waitForElasticsearch(installation, USERNAME, PASSWORD);
-            ServerUtils.runElasticsearchTests(USERNAME, PASSWORD, ServerUtils.getCaCert(installation));
+            waitForElasticsearch(installation, "elastic", ELASTIC_PASSWORD);
+            runElasticsearchTestsAsElastic(ELASTIC_PASSWORD);
         } finally {
             if (tempDir != null) {
                 rm(tempDir);
diff --git a/qa/os/src/test/java/org/elasticsearch/packaging/test/PackageTests.java b/qa/os/src/test/java/org/elasticsearch/packaging/test/PackageTests.java
index 998e3bf6d53c5..bf00d7d6fc184 100644
--- a/qa/os/src/test/java/org/elasticsearch/packaging/test/PackageTests.java
+++ b/qa/os/src/test/java/org/elasticsearch/packaging/test/PackageTests.java
@@ -8,7 +8,6 @@
 
 package org.elasticsearch.packaging.test;
 
-import org.apache.http.client.fluent.Request;
 import org.elasticsearch.packaging.util.FileUtils;
 import org.elasticsearch.packaging.util.Packages;
 import org.elasticsearch.packaging.util.Shell.Result;
@@ -40,8 +39,6 @@
 import static org.elasticsearch.packaging.util.Packages.verifyPackageInstallation;
 import static org.elasticsearch.packaging.util.Platforms.getOsRelease;
 import static org.elasticsearch.packaging.util.Platforms.isSystemd;
-import static org.elasticsearch.packaging.util.ServerUtils.makeRequest;
-import static org.elasticsearch.packaging.util.ServerUtils.runElasticsearchTests;
 import static org.hamcrest.CoreMatchers.equalTo;
 import static org.hamcrest.CoreMatchers.not;
 import static org.hamcrest.Matchers.containsString;
@@ -126,7 +123,7 @@ public void test34CustomJvmOptionsDirectoryFile() throws Exception {
 
         startElasticsearch();
 
-        final String nodesResponse = makeRequest(Request.Get("http://localhost:9200/_nodes"));
+        final String nodesResponse = makeRequest("http://localhost:9200/_nodes");
         assertThat(nodesResponse, containsString("\"heap_init_in_bytes\":536870912"));
 
         stopElasticsearch();
@@ -288,7 +285,7 @@ public void test81CustomPathConfAndJvmOptions() throws Exception {
 
             startElasticsearch();
 
-            final String nodesResponse = makeRequest(Request.Get("http://localhost:9200/_nodes"));
+            final String nodesResponse = makeRequest("http://localhost:9200/_nodes");
             assertThat(nodesResponse, containsString("\"heap_init_in_bytes\":536870912"));
             assertThat(nodesResponse, containsString("\"using_compressed_ordinary_object_pointers\":\"false\""));
 
diff --git a/qa/os/src/test/java/org/elasticsearch/packaging/test/PackageUpgradeTests.java b/qa/os/src/test/java/org/elasticsearch/packaging/test/PackageUpgradeTests.java
index 94f86aedcea79..9cd74f04c289f 100644
--- a/qa/os/src/test/java/org/elasticsearch/packaging/test/PackageUpgradeTests.java
+++ b/qa/os/src/test/java/org/elasticsearch/packaging/test/PackageUpgradeTests.java
@@ -12,13 +12,13 @@
 import org.apache.http.entity.ContentType;
 import org.elasticsearch.packaging.util.Distribution;
 import org.elasticsearch.packaging.util.Packages;
+import org.elasticsearch.packaging.util.ServerUtils;
 
 import java.nio.file.Paths;
 
 import static org.elasticsearch.packaging.util.Packages.assertInstalled;
 import static org.elasticsearch.packaging.util.Packages.installPackage;
 import static org.elasticsearch.packaging.util.Packages.verifyPackageInstallation;
-import static org.elasticsearch.packaging.util.ServerUtils.makeRequest;
 import static org.hamcrest.Matchers.containsString;
 
 public class PackageUpgradeTests extends PackagingTestCase {
@@ -44,25 +44,25 @@ public void test12SetupBwcVersion() throws Exception {
         startElasticsearch();
 
         // create indexes explicitly with 0 replicas so when restarting we can reach green state
-        makeRequest(
+        ServerUtils.makeRequest(
             Request.Put("http://localhost:9200/library")
                 .bodyString("{\"settings\":{\"index\":{\"number_of_replicas\":0}}}", ContentType.APPLICATION_JSON)
         );
-        makeRequest(
+        ServerUtils.makeRequest(
             Request.Put("http://localhost:9200/library2")
                 .bodyString("{\"settings\":{\"index\":{\"number_of_replicas\":0}}}", ContentType.APPLICATION_JSON)
         );
 
         // add some docs
-        makeRequest(
+        ServerUtils.makeRequest(
             Request.Post("http://localhost:9200/library/_doc/1?refresh=true&pretty")
                 .bodyString("{ \"title\": \"Elasticsearch - The Definitive Guide\"}", ContentType.APPLICATION_JSON)
         );
-        makeRequest(
+        ServerUtils.makeRequest(
             Request.Post("http://localhost:9200/library/_doc/2?refresh=true&pretty")
                 .bodyString("{ \"title\": \"Brave New World\"}", ContentType.APPLICATION_JSON)
         );
-        makeRequest(
+        ServerUtils.makeRequest(
             Request.Post("http://localhost:9200/library2/_doc/1?refresh=true&pretty")
                 .bodyString("{ \"title\": \"The Left Hand of Darkness\"}", ContentType.APPLICATION_JSON)
         );
@@ -91,11 +91,26 @@ public void test21CheckUpgradedVersion() throws Exception {
     private void assertDocsExist() throws Exception {
         // We can properly handle this as part of https://github.com/elastic/elasticsearch/issues/75940
         // For now we can use elastic with "keystore.seed" as we set it explicitly in PackageUpgradeTests#test11ModifyKeystore
-        String response1 = makeRequest(Request.Get("http://localhost:9200/library/_doc/1?pretty"), "elastic", "keystore_seed", null);
+        String response1 = ServerUtils.makeRequest(
+            Request.Get("http://localhost:9200/library/_doc/1?pretty"),
+            "elastic",
+            "keystore_seed",
+            null
+        );
         assertThat(response1, containsString("Elasticsearch"));
-        String response2 = makeRequest(Request.Get("http://localhost:9200/library/_doc/2?pretty"), "elastic", "keystore_seed", null);
+        String response2 = ServerUtils.makeRequest(
+            Request.Get("http://localhost:9200/library/_doc/2?pretty"),
+            "elastic",
+            "keystore_seed",
+            null
+        );
         assertThat(response2, containsString("World"));
-        String response3 = makeRequest(Request.Get("http://localhost:9200/library2/_doc/1?pretty"), "elastic", "keystore_seed", null);
+        String response3 = ServerUtils.makeRequest(
+            Request.Get("http://localhost:9200/library2/_doc/1?pretty"),
+            "elastic",
+            "keystore_seed",
+            null
+        );
         assertThat(response3, containsString("Darkness"));
     }
 }
diff --git a/qa/os/src/test/java/org/elasticsearch/packaging/test/PackagingTestCase.java b/qa/os/src/test/java/org/elasticsearch/packaging/test/PackagingTestCase.java
index 1acd9c7ef11ff..8c6268b399951 100644
--- a/qa/os/src/test/java/org/elasticsearch/packaging/test/PackagingTestCase.java
+++ b/qa/os/src/test/java/org/elasticsearch/packaging/test/PackagingTestCase.java
@@ -15,11 +15,13 @@
 import com.carrotsearch.randomizedtesting.annotations.TestMethodProviders;
 import com.carrotsearch.randomizedtesting.annotations.Timeout;
 
+import org.apache.http.client.fluent.Request;
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
 import org.elasticsearch.Version;
 import org.elasticsearch.core.CheckedConsumer;
 import org.elasticsearch.core.CheckedRunnable;
+import org.elasticsearch.core.Tuple;
 import org.elasticsearch.core.internal.io.IOUtils;
 import org.elasticsearch.packaging.util.Archives;
 import org.elasticsearch.packaging.util.Distribution;
@@ -28,6 +30,7 @@
 import org.elasticsearch.packaging.util.Installation;
 import org.elasticsearch.packaging.util.Packages;
 import org.elasticsearch.packaging.util.Platforms;
+import org.elasticsearch.packaging.util.ServerUtils;
 import org.elasticsearch.packaging.util.Shell;
 import org.elasticsearch.packaging.util.docker.Docker;
 import org.elasticsearch.packaging.util.docker.DockerFileMatcher;
@@ -86,6 +89,7 @@
 import static org.hamcrest.CoreMatchers.equalTo;
 import static org.hamcrest.Matchers.contains;
 import static org.hamcrest.Matchers.hasItem;
+import static org.hamcrest.Matchers.is;
 import static org.hamcrest.Matchers.not;
 import static org.junit.Assume.assumeFalse;
 import static org.junit.Assume.assumeTrue;
@@ -133,6 +137,7 @@ public abstract class PackagingTestCase extends Assert {
 
     // the current installation of the distribution being tested
     protected static Installation installation;
+    protected static Tuple<String, String> fileSuperuserForInstallation;
 
     private static boolean failed;
 
@@ -463,6 +468,50 @@ public void assertElasticsearchFailure(Shell.Result result, List<String> expecte
         }
     }
 
+    public void setFileSuperuser(String username, String password) {
+        assertThat(installation, Matchers.not(Matchers.nullValue()));
+        assertThat(fileSuperuserForInstallation, Matchers.nullValue());
+        Shell.Result result = sh.run(
+            installation.executables().usersTool + " useradd " + username + " -p " + password + " -r " + "superuser"
+        );
+        assertThat(result.isSuccess(), is(true));
+        fileSuperuserForInstallation = new Tuple<>(username, password);
+    }
+
+    public void runElasticsearchTestsAsElastic(String elasticPassword) throws Exception {
+        ServerUtils.runElasticsearchTests("elastic", elasticPassword, ServerUtils.getCaCert(installation));
+    }
+
+    public void runElasticsearchTests() throws Exception {
+        ServerUtils.runElasticsearchTests(
+            fileSuperuserForInstallation.v1(),
+            fileSuperuserForInstallation.v2(),
+            ServerUtils.getCaCert(installation)
+        );
+    }
+
+    public String makeRequest(String request) throws Exception {
+        return ServerUtils.makeRequest(
+            Request.Get(request),
+            fileSuperuserForInstallation.v1(),
+            fileSuperuserForInstallation.v2(),
+            ServerUtils.getCaCert(installation)
+        );
+    }
+
+    public String makeRequestAsElastic(String request, String elasticPassword) throws Exception {
+        return ServerUtils.makeRequest(Request.Get(request), "elastic", elasticPassword, ServerUtils.getCaCert(installation));
+    }
+
+    public int makeRequestAsElastic(String elasticPassword) throws Exception {
+        return ServerUtils.makeRequestAndGetStatus(
+            Request.Get("https://localhost:9200"),
+            "elastic",
+            elasticPassword,
+            ServerUtils.getCaCert(installation)
+        );
+    }
+
     public static Path getRootTempDir() {
         if (distribution().isPackage()) {
             // The custom config directory is not under /tmp or /var/tmp because
@@ -675,6 +724,10 @@ public static void verifySecurityNotAutoConfigured(Installation es) throws Excep
         assertThat(getAutoConfigDirName(es).isPresent(), Matchers.is(false));
         List<String> configLines = Files.readAllLines(es.config("elasticsearch.yml"));
         assertThat(configLines, not(contains(containsString("automatically generated in order to configure Security"))));
+        Path caCert = ServerUtils.getCaCert(installation);
+        if (caCert != null) {
+            assertThat(caCert.toString(), Matchers.not(Matchers.containsString("tls_auto_config_initial_node")));
+        }
     }
 
     public static Optional<String> getAutoConfigDirName(Installation es) {
diff --git a/qa/os/src/test/java/org/elasticsearch/packaging/test/PluginCliTests.java b/qa/os/src/test/java/org/elasticsearch/packaging/test/PluginCliTests.java
index 4255f2b4cdad6..0195af1d54c38 100644
--- a/qa/os/src/test/java/org/elasticsearch/packaging/test/PluginCliTests.java
+++ b/qa/os/src/test/java/org/elasticsearch/packaging/test/PluginCliTests.java
@@ -8,11 +8,9 @@
 
 package org.elasticsearch.packaging.test;
 
-import org.apache.http.client.fluent.Request;
 import org.elasticsearch.packaging.test.PackagingTestCase.AwaitsFix;
 import org.elasticsearch.packaging.util.Installation;
 import org.elasticsearch.packaging.util.Platforms;
-import org.elasticsearch.packaging.util.ServerUtils;
 import org.elasticsearch.packaging.util.Shell;
 import org.junit.Before;
 
@@ -20,7 +18,6 @@
 import java.nio.file.Path;
 import java.nio.file.Paths;
 
-import static org.elasticsearch.packaging.util.ServerUtils.makeRequest;
 import static org.hamcrest.Matchers.containsString;
 import static org.hamcrest.Matchers.equalTo;
 import static org.junit.Assume.assumeFalse;
@@ -31,8 +28,6 @@ public class PluginCliTests extends PackagingTestCase {
 
     private static final String EXAMPLE_PLUGIN_NAME = "custom-settings";
     private static final Path EXAMPLE_PLUGIN_ZIP;
-    private static String superuser = "test_superuser";
-    private static String superuserPassword = "test_superuser";
     static {
         // re-read before each test so the plugin path can be manipulated within tests
         EXAMPLE_PLUGIN_ZIP = Paths.get(System.getProperty("tests.example-plugin", "/dummy/path"));
@@ -61,10 +56,7 @@ private void assertWithExamplePlugin(PluginAction action) throws Exception {
 
     public void test10Install() throws Exception {
         install();
-        Shell.Result result = sh.run(
-            installation.executables().usersTool + " useradd " + superuser + " -p " + superuserPassword + " -r " + "superuser"
-        );
-        assumeTrue(result.isSuccess());
+        setFileSuperuser("test_superuser", "test_superuser_password");
     }
 
     public void test20SymlinkPluginsDir() throws Exception {
@@ -81,21 +73,11 @@ public void test20SymlinkPluginsDir() throws Exception {
         String protocol = distribution.isPackage() ? "http" : "https";
         assertWithExamplePlugin(installResult -> {
             assertWhileRunning(() -> {
-                final String pluginsResponse = makeRequest(
-                    Request.Get(protocol + "://localhost:9200/_cat/plugins?h=component"),
-                    superuser,
-                    superuserPassword,
-                    ServerUtils.getCaCert(installation)
-                ).strip();
+                final String pluginsResponse = makeRequest(protocol + "://localhost:9200/_cat/plugins?h=component").strip();
                 assertThat(pluginsResponse, equalTo(EXAMPLE_PLUGIN_NAME));
 
                 String settingsPath = "_cluster/settings?include_defaults&filter_path=defaults.custom.simple";
-                final String settingsResponse = makeRequest(
-                    Request.Get(protocol + "://localhost:9200/" + settingsPath),
-                    superuser,
-                    superuserPassword,
-                    ServerUtils.getCaCert(installation)
-                ).strip();
+                final String settingsResponse = makeRequest(protocol + "://localhost:9200/" + settingsPath).strip();
                 assertThat(settingsResponse, equalTo("{\"defaults\":{\"custom\":{\"simple\":\"foo\"}}}"));
             });
         });
diff --git a/qa/os/src/test/java/org/elasticsearch/packaging/test/WindowsServiceTests.java b/qa/os/src/test/java/org/elasticsearch/packaging/test/WindowsServiceTests.java
index 108fee48d6dd0..4877274222b91 100644
--- a/qa/os/src/test/java/org/elasticsearch/packaging/test/WindowsServiceTests.java
+++ b/qa/os/src/test/java/org/elasticsearch/packaging/test/WindowsServiceTests.java
@@ -30,15 +30,12 @@
 import static org.elasticsearch.packaging.util.FileUtils.mv;
 import static org.hamcrest.CoreMatchers.containsString;
 import static org.hamcrest.CoreMatchers.equalTo;
-import static org.hamcrest.Matchers.is;
 
 public class WindowsServiceTests extends PackagingTestCase {
 
     private static final String DEFAULT_ID = "elasticsearch-service-x64";
     private static final String DEFAULT_DISPLAY_NAME = "Elasticsearch " + FileUtils.getCurrentVersion() + " (elasticsearch-service-x64)";
     private static String serviceScript;
-    private static String superuser = "test_superuser";
-    private static String superuserPassword = "test_superuser";
 
     @BeforeClass
     public static void ensureWindows() {
@@ -96,10 +93,7 @@ private void assertExit(Result result, String script, int exitCode) {
     public void test10InstallArchive() throws Exception {
         installation = installArchive(sh, distribution());
         verifyArchiveInstallation(installation, distribution());
-        Shell.Result result = sh.run(
-            installation.executables().usersTool + " useradd " + superuser + " -p " + superuserPassword + " -r " + "superuser"
-        );
-        assertThat(result.isSuccess(), is(true));
+        setFileSuperuser("test_superuser", "test_superuser_password");
         serviceScript = installation.bin("elasticsearch-service.bat").toString();
     }
 
@@ -179,7 +173,7 @@ public void test21CustomizeServiceDisplayName() {
     // NOTE: service description is not attainable through any powershell api, so checking it is not possible...
     public void assertStartedAndStop() throws Exception {
         ServerUtils.waitForElasticsearch(installation);
-        ServerUtils.runElasticsearchTests(superuser, superuserPassword, ServerUtils.getCaCert(installation));
+        runElasticsearchTests();
 
         assertCommand(serviceScript + " stop");
         assertService(DEFAULT_ID, "Stopped", DEFAULT_DISPLAY_NAME);