by John Gifford.
I got it sorted of sorts...
We've now got Apache 2.4 driving the internal LAN access over http while the external facing site is IIS7 with just https. So externally the whole site is https but haven't found any problems so far with content.
Currently working on getting the NTLM SSO part working inside....