Paul,
There are 2 different URLs for the Canvas and Page Tab URLs.. there's the non-secure one and the Secure Canvas and Secure Page Tab URL. You need to set both and, even if the 'non-https' one always redirects to the https version, you need to leave it without http. That's just a Facebook requirement and we can't change that.
I hope that helps explain, but if you need anything else, just let us know.
Thanks,
Alex