Splunk BYOL HEC in Azure

Hi

Do we need a cert that is signed from a public CA for the hec to onboard the nsg logs?

Reason I am asking is because when onboarding aws logs through firehose to hec required the hec to have certificate that was signed by the public CA. Wondering is it the same case when onboarding nsg log.

Also, if the HEC is behind load balancer, will it still work?