The shop is running only on HTTPS, but the hreflang gets HTTP
We are running it in a web farm with a reverse proxy, so the "internal calls" within the web farm are HTTP.
I guess you are constructing the protocol of the hreflang URL based on current request instead of the setting (Store.SslEnabled).
Can you fix this?