This is working as intended, for now. Officially, we do not fully support https access yet, and none of our certificates are valid for meta sites. You can get a full explanation of that by Adam Lear on our main meta:
... you can't have a wildcard in the middle of a cert, so meta.*.stackexchange.com could never be a thing and we're not about to start registering/maintaining 100+ certs.
So. We're working on moving meta sites to a different URL scheme (*.meta.stackexchange.com) to get around this. ...
We do only display https links if you're visiting the site in https already, and we realize that this pretty much breaks Meta for the unsuspecting users. For now, the only solution we can really offer is to add an exception for the Meta sites you regularly visit so that it doesn't interrupt your normal activity if you're browsing on https, at least until we get around to fixing this issue and pushing out full support for it. We can't exactly change the link to the non-https version because that would sort of break the excepted result for users who have added such exceptions and expect to still be browsing a secure version of the site.
As far as the 403 Forbidden, this is a CloudFlare issue, and I'll ask around to see why that is showing up again.