As mentioned in the original post, in my case certificate and everything is correct and valid but all connections to the outside are handled by a reverse-proxy (nginx, obviously ;-), while connection to discourse goes over unix socket. Meaning I have
templates/web.socketed.template.yml
rather than any of those you mention. Still - this should not need to cause static URLs have hardcoded explicit http: schema