I'm also using Zen and ran into the same issue. Rather than fight and try to find the files on the various appliances, I purchased a certificate from a CA. I generated the CSR from the gateway.
This solved my issue; I was able to .crt file delivered by the CA to a PEM. After I manually combined the keys into one file, I was able upload it to Zen.
OK so i followed you instructions and set up a HTTPS rule to forward traffic from the balancer to the Horizon server.
When I try to do this from the outside i get: HTTP message forwarded as HTTPs
not sure why maybe im doing something wrong.