irule and ssl profile

you apply an irule with the redirect on the the port 80 virtual server and create (if you haven't already) a port 443 virtual server with an client side ssl profile indeed.

There's also a built-in iRule to do this: _sys_https_redirect

As boneyard states, apply the iRule on the HTTP (port 80) VIP and it will redirect all requests to the same host name on HTTPS (port 443). This assumes you have an HTTPS VIP created and listening on the same IP address as the port 80 VIP.