If you own/trust the Reverse Proxy, Load Balancer, and Intended Server(s) then:
Your client mobile phone has the client certificate (through some secure means) which it uses to authenticate to the Reverse Proxy.
The Reverse Proxy handles the SSL/TLS decryption, then forwards the traffic onto the Load Balancer and the intended server (unencrypted).
Load Balancer and Intended Server are hidden from the internet behind routers/firewalls.
The Reverse proxy is configured to only allow connections from the allowed client certificates.
- Alternatively all the SSL traffic could be passed through the Reverse Proxy and decrypted on the Load Balancer or Intended Servers, but that only allows IP based load balancing.
Unless I am misunderstanding some part of your protocol, I am assuming here that the Certificate you are talking about is for Authentication to the SSL/TLS website and not some other certificate.
Edited to add:
You added a comment above to explain that it is the initial certificate creation (CSR being signed) that needs to be encrypted.
In this scenario you need to determine what initial authentication you require.
Are you tying the certificate to a real world or prior identity? Then apply some authentication such as username/password through the SSL tunnel to initially create it.
But if you are just creating a random certificate to hang a new identity on, then SSL/TLS from mobile app to server should be OK, verifying the server certificate first is probably a good additional security measure.