UTM 9 - WAF - HTTPS Certificate passing traffic via HTTPS, not HTTP

Hello everyone, my setup:

Ubuntu Webserver named "webserver.domain.net" with an IP address of 192.168.1.10

Website running on Webserver named "weather.domain.net" with an IP address of 192.168.1.10

Created LetsEncrypt certs on webserver using certonly and used the name "weather.domain.net" (of course domain.net is fictitious and is not what was used)

Had to open up full NAT to webserver to allow this to work so communication could come in over 443 to the real webserver

Closed full NAT

uploaded the PK12 to Cert Manager

Changed the Virtual Webserver to HTTPS/Redirect and added the cert

Now, here's what's happening:

Users from outside, when hitting http://weather.domain.net are getting redirected, as it should, to https://weather.domain.net.

HOWEVER, they're hitting an Ubuntu Apache2 landing page.

The Apache2 logs on the webserver.domain.net are showing the below.  This is the traffic coming from the UTM (192.168.1.1) as a get HTTP, however it shows it's coming in for HTTPS://weather.domain.net.  Why?  I thought the Sophos UTM was going to broker all traffic, 100% in HTTP on the inside, but the outside would handle the HTTPS and offload it.  Where would you look first?

Thanks for any help!

192.168.1.1 - - [12/Dec/2016:11:01:15 -0600] "GET / HTTP/1.1" 200 11821 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_1_1 like Mac OS X) AppleWebKit/602.2.14 (KHTML, like Gecko) Version/10.0 Mobile/14B100 Safari/602.1"
192.168.1.1 - - [12/Dec/2016:11:01:15 -0600] "GET /icons/ubuntu-logo.png HTTP/1.1" 404 513 "https://weather.DOMAIN.net/" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_1_1 like Mac OS X) AppleWebKit/602.2.14 (KHTML, like Gecko) Version/10.0 Mobile/14B100 Safari/602.1"