https in ProxyPass behaviour

[GBBx]

Hello,

I have an Apache reverse proxy in front of a keycloak instance (keycloak.example.com) and a URL I reach after login via keycloak (my.example.com).
This config works:

<VirtualHost *:443>
  ServerName my.example.com
  UseCanonicalName On
  ProxyPreserveHost On
  ServerAdmin ***
  DocumentRoot '/var/www/html'
  LogFormat ...
  ErrorLog  ...
  CustomLog ...
  LogLevel warn
  Header always set Strict-Transport-Security 'max-age=31536000'
  RequestHeader set Authorization "Bearer %{OIDC_access_token}e" env=OIDC_access_token
  SSLEngine On
  SSLCompression Off
  SSLProtocol -ALL +TLSv1.2 +TLSv1.3
  SSLHonorCipherOrder On
  SSLCipherSuite 'AES256+EECDH:AES256+EDH'
  SSLCertificateFile /etc/letsencrypt/live/my.example.com/fullchain.pem
  SSLCertificateKeyFile /etc/letsencrypt/live/my.example.com/privkey.pem
  SSLUseStapling  On
  SSLOCSPProxyURL ...
  SSLProxyEngine On
  ProxyPreserveHost On
  RequestHeader set X-Forwarded-Proto "https"
  RequestHeader set X-Forwarded-Port "443"
  OIDCProviderMetadataURL https://keycloak.example.com/auth/realms/my/.well-known/openid-configuration
  OIDCSessionInactivityTimeout 36000
  OIDCSessionMaxDuration 36000
  OIDCRefreshAccessTokenBeforeExpiry 60 logout_on_error
  OIDCClientID my
  OIDCClientSecret ***
  OIDCCryptoPassphrase ***
  OIDCRedirectURI https://my.example.com/home
  <Location "/">
    AuthType         openid-connect
    Require          valid-user
    ProxyPass        "http://<IP address>:80/" connectiontimeout=10 timeout=300
    ProxyPassReverse "http://<IP address>:80/"
  </Location>
</VirtualHost>

Now I'd like to change http to https in ProxyPass. I make the following changes:

ProxyPreserveHost Off
...
ProxyPass "https://internal.example.com:443"  connectiontimeout=10 timeout=300
ProxyPassReverse "https://internal.example.com:443"

"internal.example.com" is name that only exists internally. It is not accessible from outside but it is accessible from the Apache server.
If I navigate to my.exmple.com in the browser I get redirected to internal.example.com and the connection (obviously) fails.

Is there a way to make it work?

[GBBx]

Hi,
I experimented a bit more, I understand there's no way around setting ProxyPreserveHost On but then I get SSL errors which is kinda expected (my.example.com != internal.example.com).
Now I set SSLProxyCheckPeerName Off but it feels a bit wrong. Is there a way to set SSLProxyCheckPeerName On without SSL issues?

[GBBx]

This combination seems to work now:

ProxyPreserveHost Off
SSLProxyCheckPeerName On
RequestHeader set X-Forwarded-Host "external.example.com"
OIDCXForwardedHeaders X-Forwarded-Host