Use Secure URLs on Storefront = Yes Use Secure URLs in Admin = Yes Secure Base URL = starts with HTTPS
Why does my sitemap not start each link with https?
https://github.com/magento/magento2/issues/8644 shows this issue to have been fixed in versions 2.1.9 and 2.2.0. The workaround below appears to work if you're unable to update your store.
Update the Base URL of the store you are generating the sitemap for.
From the admin dashboard: