How to add a TLS listener to a network load balancer in AWS - amazon-elb

Question

I'm attempting to add a TLS listener to a network load balancer. From https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/command-options-general.html#command-options-general-elbv2-listener this shouldn't be possible, since the SSLCertificateArns and SSLPolicy params note "This option is only applicable to environments with an Application Load Balancer".
This is the policy (some details masked XXX):
option_settings:
aws:elbv2:listener:443:
DefaultProcess: default
ListenerEnabled: 'true'
Protocol: TCP
SSLCertificateArns: arn:aws:acm:XXX
SSLPolicy: ELBSecurityPolicy-XXX
Sure, fine, I get Failed Environment update activity. Reason: Configuration validation exception: Invalid option value: 'null' (Namespace: 'aws:elbv2:listener:443', OptionName: 'SSLCertificateArns'): SSL options are not supported for Network Load Balancers. when I do this. Other AWS docs support this position, e.g. https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/environments-cfg-nlb.html#environments-cfg-nlb-intro.
However - I can add a TLS listener and specify the security policy and certificate via the AWS console. I also tried Protocol: TLS in option_settings, which is what I can use in the AWS console, but I get error Failed Environment update activity. Reason: Configuration validation exception: Invalid option value: 'TLS' (Namespace: 'aws:elbv2:listener:443', OptionName: 'Protocol'): Only TCP Protocols are supported for Network Load Balancers .. Is this simply something that the AWS console does and can't be set via option_settings, or am I misunderstanding something important?