TLS terminates at the load balancer, but policy also requires encryption between it and the backends. What is needed?

1. Remove all backend certificates.
2. Assume the frontend certificate automatically secures every downstream connection.
3. Configure and validate the backend TLS connection and relevant certificate trust.
4. Change only the HTTP response header.