Normally you would use Traefik to terminate TLS/SSL and just forward plain HTTP to the target (Apache). If you don't trust your network (someone might be listening to the internal traffic), then you can forward requests with HTTPS (encrypted), then your target also needs to handle TLS/SSL.