Terminate the SSL at an apache instead of ELB

Yes, you can use the NLB to route TCP/443 traffic to your ECS cluster. NLB does not terminate SSL, it just passes on the packets.

Alternately you could use multiple ALBs.