I am trying to ensure that all traffic within my AWS VPC has in-transit encryption.

My architecture is currently Cloudfront -> REST API Gateway -> NLB -> ALB -> ECS Target Groups.

My idea was to make use of an Envoy sidecar to terminate TLS at the ECS container (following this). However, I am now struggling to figure out how to validate the TLS certificate that will be used for HTTPS between the ALB and the ECS container and envoy sidecar. I would prefer to use an AWS managed TLS certificate in ACM for the ALB rather than one managed by us.

Would it use the same certificate that is used by the HTTPS listener that integrates with API Gateway? Or an internal AWS certificate?