In order to redirect http to https, you have to define a listener rule in the ALB that redirects all traffic on port 80 to port 443 (of the ALB) with the original path and query parameters. The status code should be a 301 (permanent redirection). That's the context between the client and the ALB.

The certificate for the domain(s) will be installed in the ALB.

The target group for the ALB would contain the http target (or be filled in by an auto-scaling group's members in case you have multiple targets from an auto-scaling group). Your application server would only see http requests coming from the ALB. You won't get any https requests.

The important point about rewriting http requests (from the client perspective) to https requests (client perspective again) is to define that rule in the ALB, and make that rule redirect requests for all paths.

On the other hand, why do you need the ALB if you have an NGINX in there, anyway? I would rather settle for a simple NLB and handle http/https redirections etc. in the NGINX itself.

Cheers,
--j.