I found the problem.  When creating the URLs for the menu, the code ultimately calls GetFriendlyAlias.  It checks whether the current URL request starts with the portal alias - if it does, it prefixes the new URL with the alias - otherwise, it does not and it stays a relative reference.  (Back in the browser, the relative reference knows nothing about the real alias and it looks like the reference is off the domain name).  All should be well, except that GetFriendlyAlias adds the port to the alias before comparing.  AddPort will not add port 80, but will add Port 443 if the site is secure.  Therefore, the original request will not start with the alias -- ultimately causing all pages in the menu to use relative references without the alias.

Probably not the best explanation.  However, I would think this would cause problems in a number of sites that (1) use portals with aliases and (2) use SSL.  I have spent too many hours figuring this out (and learning a lot about the DNN internals!).  Is this something that could get remedied in a future release?

Thanks,
Scott