Sure, but the point is not so much about which one to use but that the terminating point listening on 443 should sit outside of his network.

So he will either need a cloud service, or accept that he will have to add :12400 to his URLs.