A regional API Gateway REST API uses a custom domain and has its default endpoint disabled. Internal teams call the API, and the company wants to add mutual TLS (mTLS) for additional authentication between clients and the API. Which steps are needed to implement mTLS for this API? (Choose two.)

To implement mTLS, clients need certificates issued by a trusted Certificate Authority (CA). AWS Certificate Manager (ACM) Private CA allows you to create a private CA and issue client certificates, which is a common and secure practice for internal applications. For API Gateway to validate these client certificates, it needs a trust store containing the root certificate of the CA that issued them. Uploading this root certificate to an S3 bucket and configuring API Gateway to use it as the trust store enables the API to verify the authenticity of client certificates during the TLS handshake. Obtaining client certificates signed by a public CA is less common for internal mTLS, and importing client certificates (rather than the CA root) into ACM is not how API Gateway's trust store works. Client private keys are used by the client, not as part of API Gateway's trust store.