An ALB is configured for HTTPS from clients and HTTP to targets. Security now requires encrypted transport on both legs. Which change directly addresses the missing leg?

1. Move the HTTP target port from 80 to 443 without enabling TLS.
2. Change the client certificate without changing the target protocol.
3. Enable Route 53 DNSSEC to encrypt load balancer backend packets.
4. Use an HTTPS target group and configure targets to accept TLS connections.