I figured this out. The upgrade also included some upstream updates that replaced the wp-config.php. I had to add back the Pantheon-specific code to force https and to redirect back to the calling site correctly:
$_SERVER[‘SERVER_NAME’] = $_SERVER[‘HTTP_HOST’];
if (isset($_ENV[‘PANTHEON_ENVIRONMENT’])) {
if (isset($_SERVER[‘HTTP_USER_AGENT_HTTPS’]) && $_SERVER[‘HTTP_USER_AGENT_HTTPS’] === ‘ON’) {
$_SERVER[‘SERVER_PORT’] = 443; }
else {
$_SERVER[‘SERVER_PORT’] = 80;
}
}
// Require HTTPS across all Pantheon environments
// Check if Drupal or WordPress is running via command line
if (isset($_SERVER[‘PANTHEON_ENVIRONMENT’]) && ($_SERVER[‘HTTPS’] === ‘OFF’) && (php_sapi_name() != “cli”)) {
if (!isset($_SERVER[‘HTTP_USER_AGENT_HTTPS’]) || (isset($_SERVER[‘HTTP_USER_AGENT_HTTPS’]) && $_SERVER[‘HTTP_USER_AGENT_HTTPS’] != ‘ON’)) {
header(‘HTTP/1.0 301 Moved Permanently’);
header(‘Location: https://’. $_SERVER[‘HTTP_HOST’] . $_SERVER[‘REQUEST_URI’]);
exit();
# Name transaction “redirect” in New Relic for improved reporting (optional)
if (extension_loaded(‘newrelic’)) {
newrelic_name_transaction(“redirect”);
}
}
}