How to configure Keycloak Operator Custom Resource for Ingress

Securing applications
1

Operator keycloak version 25.0.4
I understand that by default the ingress created by the operator does not terminate certificate.
So I am missing this entry in ingress object:
tls:

Then the ingress object attaches itself to an NLB but only port 80. I cant see 443.

In ingress I have this entry:
ingress:
annotations:
cert-manager.io/cluster-issuer: letsencrypt-prod
I assume, I dont need this in the ingress instead I need to configure the certificate in the pod.

I also added:
proxy:
headers: xforwarded

How can I make sure that the line is encrypted from the NLB → nginx controller -->keycloak pod? How to test it?