It is better to have the nginx or haproxy plugin inbetween. They can also handle the Let's Encrypt ACME challenge for you so you don't need to do anything for that in the backend if you also install the ACME plugin.In that case, you can also go via HTTP over TCP/80 to your backend, if the request is done via HTTPS. In that case NAT is wrong, you will need a simple Pass rule on the WAN interface to your local reverse proxy (pass TCP/80 and pass TCP+UDP/443 both with the target IP "WAN Interface"). In that case, you also have to move your web interface to a different port.Documentation and tutorials can be found here: https://docs.opnsense.org/plugins.html#web---But yes, you can port forward TCP/80 and TCP+UDP/443 to your webserver if you like, then you have to manage everything there, including protocol security, firewall and TLS.
Use nginx as a reverse proxy to your Apache server. Nginx will receive client queries and then proxy them to the backend Apache server. All the https work is done on the frontend nginx server
