For an open source project is it OK to modify the original LICENSE.txt file from https://www.apache.org/licenses/LICENSE-2.0.txt and also the source file headers to use https instead of http for the links to the license?
I do not want my users to accidentally follow non-https links.
Sure, this is not a material change IMHO. You could also contact the Apache Foundation on the legal-discuss list to discuss this change.
But for practical purposes, changing an original license text even if just for a single character is not a great idea. You could instead create your NOTICE with the proper HTTPS url.
As a side and funny note, the bare link to https://apache.org/ is reported as not having a proper SSL certificate in FF. ;)
*.apache.org) are not valid for the domain without wildcards (apache.org). That's why the cert is not accepted. Someone should probably report this to the Apache guys.
As long as you get the same result for either URL right now it shouldn't be a violation of their license (as determined by following that URL at this time). However, as far as I know the question of having substantive parts of the license contained in a document referenced in this way has never been tested in court, and there are a substantial number who question the applicability. This is because you are allowing a third party, that is not a party to the license, to change the license terms at any time, without notice. Usually doing that is not allowed.
