Add those lines, in the .htaccess file at the root of your site :

## Force secure connection
RewriteCond %{HTTP:X-Forwarded-Proto} =http [OR]
RewriteCond %{HTTP:X-Forwarded-Proto} =""
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Modifiy the app.url in the /web/config/app.php file

'app.url' => 'https://...',

You can now get free https certificates from the non-profit certificate authority Let's Encrypt!