AWS IOT Just-in-Time Registration of device using Android SDK

Question

I am setting up a JITR process for my android application using the AWS android SDK client. I have completed the steps of setting up the lambda function to register devices/things and attach its policy.

I am currently creating the x509 certificate when the app is started running and I store it using the AWSIotKeystoreHelper in the device for later use. but in order to sign the x509 certificate by the CA certificate and trigger the lambda function, what is the best approach that I can take to sign the X509 certificate by a CA certificate? Is it possible to do that similarly in the application code itself? if so, How am I supposed to obtain the CA certificate to the application to sign the device's x509 certificate?

I am fairly new to AWS therefore, apologies if the question doesn't make enough sense.