Couldn't you just set your site to require SSL, then modify the 403.4 custom error page to automatically redirect to https? I had used this kind of thing for years before we started terminating ssl at the load-balancer. The code on the 403-4.htm custom error page would be something like this:
<html><head><title>Error 403.4</title>
<meta name="robots" content="noindex">
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"></head>
<body>
<script language="JavaScript">
var href = self.location.href;
var originalURL = href.substring(7,href.length);
self.location = 'https://' + originalURL;
</script>
</body>
</html>
This is a pretty old script that's been around for a while and there's probably a cooler way to do it but this works fine.