...
Any protocol endpoints in the Metadata describing the SP must point to proxy.example.org.
Unless the proxy itself does not handle HTTPS at all (i.e., access to the resource is not proteced by TLS/SSL), all endpoints in the metadata should be set to HTTPS URLs. If the process by which you generate metadata does not do this for you, you'll need to perform this change yourself.
...