How can I configure Kong to replace client certificate with Kong certificate before proxy the API to AWS ALB?

we have Kong to proxy the client API to the AWS ALB. We want to implement mTLS between client API and Kong using client certificate, and then between Kong and AWS ALB using Kong certificate. so that we only need to manage the client CA within Kong, is that possible? How can we configure it? What are the steps?