Portal Access is doing unencrypted http over port 443

I have an https VS with an APM policy that displays a Webtop with several Portal Access objects. Each is defined similar to the following: "; . But tcpdump shows that the initial request goes from the Big-IP's self IP to 10.x.y.z as http on port 443, and Wireshark gives "Unencrypted HTTP protocol detected over encrypted port" warnings.

All of my other working PA configurations are http, so I can't really compare them.

What's up?