Configure API Gateway Mutual TLS

I have the SSL/TLS certificates ready and an AWS account in place; what I’m missing is the exact configuration that will let Amazon API Gateway enforce mutual TLS for my private endpoints. I’d like you to walk me through — or, if faster, directly implement — the full setup: uploading the certificate authority, attaching it to a custom domain name in API Gateway, updating the stage settings, and verifying that only clients presenting valid certificates can reach the APIs. Please keep the work confined to API Gateway and any supporting IAM or ACM steps; no other AWS services are in scope for now.

A short hand-over document or screen-share recording that shows the configuration steps, the test call with a valid client certificate, and the failed call without one will serve as the final deliverable so I can replicate the process in other environments.

Already got Client Certificates and Server Certificates, but not sure how to test and configure this.