About a year ago there was a bug in the permalink generating code for my WordPress site, which gets about 70% traffic from Google. The canonical tag started using the WP short URL format instead of the regular format.
Two weeks later, I found the bug when I noticed that my URLs were showing weird in the Google index. Instead of the full /999999/post-url-format-like-this//999999/post-url-format-like-this/
in the results, it was showing ?post_id=99999 ?post_id=99999
(or something similar).
There were no changes in traffic.
The bug was fixed, the canonical tag properly set again, and about a week later, Google had adjusted all of the indexed links back to the normal format. Painless, really.
So based on my experience, your plan should be:
- Change the canonical tag to point to the HTTPS urlURL instead.
- Google will automatically update all of the results in the index. This might take a few weeks and requires no 301 redirects. And... 95% of your traffic will be using SSL.
- Redirect logged-in users that click from another site.
Since 301 redirects do remove some of the pagerank, I don't see the point in using them right away, especially since the canonical tag should take care of the Google index.