Thank you for the feedback @shiangoli.
As mentioned above, a gateway with separate domain and TLS termination is not something we’ve had to support before so hasn’t been tested.
We think this is due to the response sent by the server. If you attempt to sign in, the server responds with a redirect url for successful sign-ins. This url is based on the Canonical URL, which in your case (I assume) is the internal URL. Unfortunately this will be sent to your browser which cannot successfully resolve the Internal URL.
It appears that because the Canonical URL is used for a number of purposes, setting a value which satisfies one purpose causes it to fail others. We don’t currently have the spare capacity to look into this right now, though the path to resolving this if you wished to investigate would be to consider all the places that Canonical URL is being used and allow it to be more finely configured - perhaps passing in a different variable.