[keycloak-user] Keycloak behind reverse proxy

I configured mutual-ssl authentication on Keycloak. That means that user coming to Keycloak does SSL handshake allowing Keycloak to extract data from client certificate and map that data to an existing user at Keycloak, and based on that authenticate the user. Now, I need to configure reverse proxy in front of Keycloak. I'm using Apache's httpd. The problem is that user's browser now does SSL handshake with the reverse proxy server instead of Keycloak and sends plain http request, disabling Keycloak to map and authenticate the user. Is there a proposed method to achieve this? Can I configure some reverse proxy (maybe not httpd) to proxy requests on the transport layer? Or should I somehow configure Keycloak for this? Maybe configure the proxy to be KC's client and do the authentication somehow? Many thanks, Nikola