How to set up a custom domain/url for a public MWAA environment?

As the title says we're looking to set up a custom url for a public network (not private) MWAA environment. I was able to find the VPC endpoint for the environment and the two private IPs associated with it, so I created an IP target group with the MWAA's same VPC, protocol HTTPS, and port 443, with a health check for status codes 200 and 302, as this guide recommends. https://docs.aws.amazon.com/mwaa/latest/userguide/vpc-vpe-access.html#vpc-vpe-access-load-balancer.

I registered the two private IP addresses on the target group, also with port 443. I also added a listener rule to our load balancer pointing to the target group using our custom URL, as we've done with other applications on our domain.

However, the target group keeps coming up unhealthy. I'm wondering if I am following the wrong instructions, I've found plenty of guides on setting up a custom url for a private MWAA, but nothing for a public MWAA. Can anybody point me in the right direction?