Better practice... Google TLS ingress to non-encrypted backend vs. TLS to Dgraph

So… I think I have it mostly set up. I have an ingress created. If I go to the http version of the ingress, I can get to graphql, but I get an SSL mismatch if I try to access the ingress via https. I have google managed cert. All that is fine. Do I need to apply a cert to the Dgraph service itself? If so, using the same cert as the ingress or the built in Dgraph cert?