When the site is set to HTTP with SSL, the http server (nginx in my case) will add a HTTPS: on tag into the request header. Fossil should identity it and use https schema for all the generated links.