The Simulate Zone option in load balancing health checks appears to address authenticated origin pull, but appears to be unavailable in the Standalone Health Check. Is it possible to not encounter the TLS error in the health check with authenticated origin pull enabled?
Going to try to have them enable it as a TCP check as this feature is not currently on health checks. If this works I will escalate it internally as I have seen another instance related to this I am following on. Currently, gathering more info.