Https communication between services in docker-compose

I have two services specified in docker-compose - api and web that depends on api. Both are aspnet core web applications

version: '3.4'

services:
  api:
    image: mywebapi
    build:
      context: .
      dockerfile: MyWebApi/Dockerfile
  ports:
    - "44380:443"

  web:
    image: mywebapp
    build:
      context: .
      dockerfile: MyWebApp/Dockerfile
    environment:
     - ApiClient__Uri=https://api
    ports:
      - "80:80"
      - "443:443"
    depends_on:
      - api

I can use self-signed dev certificates to access any of these services from localhost if I mount certificates from the host

    volumes:
     - ${APPDATA}/ASP.NET/Https:/root/.aspnet/https

But I want to access api from web via https://api/foo without mapping any api ports to the host.

How can I issue a certificate for api by some CA trusted by web? Or maybe there is another secure way to do https communication between two services?