All of our servers should come with TLS configured and enabled by default. In the Mattermost appliance specifically, we reverse proxy it with Nginx (i.e. option 2 in the Mattermost docs you linked to).

They do only ship with a self-signed certificate, but as of v14.2, Confconsole supports getting free Let's Encrypt TLS certificate, straight from your server's console.

Reading through the docs you link to, I'm almost certain that your changes have broken your server. As I hinted above, we already configure Mattermost behind a Nginx reverse proxy. My guess is that Mattermost is not able to bind to port 443, because Nginx already is. Because Mattermost isn't available on the port which Nginx is trying to connect to it on (8065), Nginx is giving a 502 error.