According to this Stack Overflow answer, it's not necessary to add HTTPS to .onion sites: https://tor.stackexchange.com/questions/6447/do-all-onion-ad...

Part four of this post also discusses HTTPS certs for .onion sites: https://blog.torproject.org/blog/facebook-hidden-services-an...