Several SEO analysis sites warn against linking to http site from a https site. If I link to https site that redirects to http, does that still violate that rule?
It's not good and it's not bad. However I'd recommend you to link to the final URL not the page that has a redirect. I don't know what SEO analysis sites told you that, but there is nothing good or bad about it. If the site has https and then most likely all finals URLs are using https certificate.
There are some problems that can appear when you don't link directly to a final URL (doesn't matter http or https):
What if that final page will have another redirect? If you link to the first url it will have two redirects. That's pretty bad especially if their site speed isn't great.
What if they will switch back to http only? You will redirect to a 404 page.
I don't know how many links you have. If it's just one - not a big deal, but if you have 10+ or even 100+ links. You will need to audit your site and update many links.
P.S.: just because now https is a SEO factor, people will create different theories about linking to http or https pages. Just make sure you link to a good source that is not spammy. That's important more than anything.
SEMrush gives this reasoning: "When moving your website from HTTP to HTTPS, it is very important to ensure that any link on your website points to a HTTPS source. Not changing your links to the HTTPS version may negatively affect user experience and their confidence in your website."
This is very dubious IMO. What exactly is this "user experience" and "confidence in your website" they talk about?
There is a certain "risk" to the user... they are moving from an environment where the network traffic is encrypted to one that is not - as in anytime an HTTP URL is requested - there is potential for MITM. There is an optional setting in IE that allows you to "Warn if changing between secure and not secure mode" - if it is such a big deal for you. But I don't see how this would be a reflection on the credibility of your site. By default, the HTTP Referer is not passed in an HTTPS to HTTP request, so information disclosure is kept minimal.
There is a reddit thread querying this same SEMRush warning and it is met with the same disbelief.
It seems there is a second part to this warning message (highlighting my own), as copied from the above reddit thread:
How to fix it
Replace all HTTP links with the new HTTPS versions. If an external link leads to a page that has no HTTPS version, remove the link.
What?! That is way too extreme IMO and would probably do more harm than good. If the site is worth linking to in the first place then keep the link!
If I link to https site that redirects to http, does that still violate that rule?
If this is really a "user experience" issue, as stated in the SEMRush warning, then yes, sticking a redirect in the middle is still going to violate that rule. In fact, it could only make things worse.
However, as mentioned, unless someone comes up with some sensible reasoning behind SEMRush's warning message, I don't think it is a problem to begin with.