In case this sounds bad for security reasons (using self-signed certs) keep in mind that the VPC network does not allow clients to spoof IP addresses or receive

In case this sounds bad for security reasons (using self-signed certs) keep in mind that the VPC network does not allow clients to spoof IP addresses or receive traffic destined for any other MAC/IP pair. So, there is no need to validate the authenticity of a host on the network because it has already been validated by the VPC software defined network, and spoofing MAC/IP, or ARP poisoning, or any of the other traditional physical network layer attacks just don't work.