How to force D8 "Configuration synchronization" to send HTTPS download URL
I forgot the SSLEngine On Apache directive in the configuration of the VHost listening on port 443.

With it, the Location header sent by Drupal contains now https scheme.