WordPress generated links – menus and home_url() – not using https despite settings

This should not be default behavior.

The home_url template tag retrieves the home URL for the current site,
optionally with the $path argument appended. The function determines
the appropriate protocol, “https” if is_ssl() and “http” otherwise. If
the $scheme argument is “http” or “https” the is_ssl() check is
overridden.

http://codex.wordpress.org/Function_Reference/home_url

There are filters involved so perhaps a plugin or theme code is breaking things.

You should update to the current release as soon as you can.