the monitoring host should have a certificate that is compatible with prometheus node_exporter client certificate authentication so that it can use certificate based authentication on nodes outside of AWS. A self-signed CA should be created for prometheus metrics collection; certificates issued for the monitoring host and node_exporter endpoints, e.g. a web_config.yml configured that points at the ca.cert, endpoint.cert, and authenticates by a certificate issued by that ca for the monitoring host.