Sorry about that code. Ordinarily I'd have had a chance to test it but didn't have a test site ready for that type of testing.
Thinking about it further, an actual redirect won't work due challenge/response on the certificate not being installed. If you load the site in a new browser you'll see what I'm talking about.
If the site were mine (or a clients of course) I'd recommend getting a certificate setup and redirecting the whole thing to HTTPS now. If you don't want to do that the certificate will at least light up the HTTPS site directly (i.e. without the insecure warning) which will allow it to be redirected properly.
That said ... you do have the canonical tags on the pages properly so a duplicate content warning will be a false positive in that the content is indeed duplicated but Google knows that the HTTPS is the primary source as far as I can tell. Your site is going into a redirect loop on HTTPS so I can't double check but it appears as though it should from the way it's displaying in the source. Happy to double check after the loop is corrected.
Dave