Terminate TLS at NLB

I'm trying to terminate TLS at the NLB.

Hence in my helm values I have:

ports:
  websecure:
    tls:
      enabled: "false"

Hitting an example ingress via http works just fine.

However hitting that same ingress via https throws 404.

I believe this may possibly be because the "Router" it creates has TLS=true...?

Thanks for any help.