You may remember I posted here about having issues using the Pound load balancer. This has been the course of the problem yet again.
I set up a dedicated box for Discourse and used the Ubuntu 14.04 (trusty) version of Pound installed via apt-get. I did this as I was no longer using SNI (dedicated IPV4 for the service) and thus no longer needed bleeding edge (Pound SNI and SAN matching / Filidor Wiese <firstname.lastname@example.org>)
I noticed that going through HTTP only with an /etc/hosts change was fine, indicating it is the load balancer.
As only recent versions of Pound have “Certificate alternate names support”, I believe that Pound was setting the wrong request URL. I confirmed this with some logging in the Varnish VCL. This was causing the issue