It's not in PHP, its in Apache. Apache's the one in charge of reading the request and passing to PHP the server variables, it's the one who made the contract th

It's not in PHP, its in Apache. Apache's the one in charge of reading the request and passing to PHP the server variables, it's the one who made the contract that HTTPS means the request was made over HTTPS, it's the one who send to the called handler the value of HTTPS and it's also the one who put the wrong value in it. It wrongly put the browser-sent header in there overwriting it's own variable (or creating it when it shouldn't).