API Gateway - "self signed certificate in certificate chain"

Question

I aim to create a custom domain for private API Gateway endpoints in VPC. 
To achieve this, I created an AWS Private CA and requested the private certificate for the domain *.test.aws.
Then created an AWS Load Balancer with a listener in HTTPS (port 443) with an already-created private certificate. The Target Group points to the IP addresses for "execute-api" endpoints inside the VPC.
The next step was to create a private Hosted Zone in Route 53, with a new A record "api.test.aws" that redirects to the ALB domain name.
Finally, set up a custom domain name with "api.test.aws" using the certificate for my API Gateway resource.

After all of these steps, whenever call the "https://api.test.aws", I get an error "self signed certificate in certificate chain" The request never reaches the target lambda function.
For instance, tested the "https://api.test.aws" which reaches the lambda (updated ALB of port 80)

Any idea what may cause the following error?

Answer

Your private CA isn't trusted, that is it doesn't appear in the CA certificate bundle of the client that's trying to hit the endpoint.

Mutual TLS Authentication may help you to achieve what it is that you want here https://aws.amazon.com/blogs/compute/introducing-mutual-tls-authentication-for-amazon-api-gateway/

Answer

Its behaving exacatly how you set it up. A AWS Private CA is techincally a self signed certificate from where you issue more ceritifcates from. 
The only to have this work I think is to install the certificate chain from the Private CA.

I believe what you should do is to create a Private API Gateway and use an ACM issued certificate instead which is signed by a trusted root certificate.

https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-private-apis.html

API Gateway - "self signed certificate in certificate chain"

Relevant content