Solved. Apache conf file for site had the following two lines in the VirtualHost
section:
RequestHeader set X_FORWARDED_PROTO 'https'
RequestHeader set X-Forwarded-Ssl on
Adding this third line did the trick:
RequestHeader set X-Forwarded-Proto "https"
Note how the original file (https://gitlab.com/gitlab-org/gitlab-recipes/commit/b9afcfd8f9543342df46bfb4327be6466d1097ce) does NOT include the correct header.