Contao 4.13 removed the web Install Tool: where should HTTPS enforcement and custom CA trust now live?

Context

We are planning a migration to Contao 4.13 LTS, where the legacy web Install Tool at /contao/install.php has been removed in favor of the Contao Manager and the contao:install-web console command. Previously, the Install Tool UI was where forced HTTPS could be toggled during setup.

Current setup and constraints

The site will run behind a reverse proxy that terminates TLS with a certificate issued by an internal CA. Contao still ships an HTTPS middleware that reads $_SERVER['HTTPS'] and redirects when CONTAO_FORCE_HTTPS is enabled, but as far as I can tell it performs no certificate-chain validation itself and assumes TLS was already terminated upstream. Outbound requests, such as extension repository checks, appear to rely on the system CA bundle or Guzzle configuration rather than anything Contao-specific.

Open questions

With the Install Tool gone, what is the documented, upgrade-safe place to enforce HTTPS in 4.13: the CONTAO_FORCE_HTTPS environment variable, web server redirect rules, or both?

For outbound HTTPS calls that must trust our internal CA, should the certificate be added to the system CA bundle, or is there a supported way to pass a custom CA to Contao's HTTP client configuration?

In a containerized deployment, is there any risk that the environment variable is silently ignored, and how can that be verified without the old Install Tool UI?