End to end SSL NLB

If we need end-to-end encryption involving NLB, is it mandatory to have a certificate installed on NLB?

No, it is not mandatory TLS can be terminated on the backend directly

Is it possible to pass through the traffic as-is to ec2 and ec2 do the decryption?

Yes

If so, what would be the listener protocol. Is that TCP or TLS? I believe target group port should be TLS.

TCP-443 as mentioned here:

"Note that if you need to pass encrypted traffic to the targets without the load balancer decrypting it, create a TCP listener on port 443 instead of creating a TLS listener. The load balancer passes the request to the target as is, without decrypting it."

However, https://docs.aws.amazon.com/elasticloadbalancing/latest/network/create-target-group.html, documentation states that target group protocol of TLS would be acceptable only if listener protocol is TLS.

You would configure Target group protocol as TLS if you are terminating the SSL on the load balancer (Also called as SSL offloading Or two way SSL, i.e. Client -> LB is SSL and then another SSL session from LB -> backend)