I would focus on the need, rather than the implementation. The user story would then simply be:
"As a user, I want any personal information I give (Company) to remain private and secure."
With HTTPS then being an implementation detail of that story. After all, if you found some other means of completing the requirement (such as not getting any personal information in the first place), then HTTPS would become irrelevant.
You could also append something like "even from a malicious attacker", which should make it more testable (see INVEST mnemonic) - make sure all common attacks (other than social engineering, which isn't really solvable...) fail.
Just keep in mind that the user shouldn't really care whether the web page is secure. They care that their data is no compromised. You could have a (potentially very large) user story for everything necessary to secure is secured. (depending on how large it is, it might invalidate INVEST, though.)
Alternately, you could bake it into your Definition of Done (see this answer). Note that the DoD is not a user story, task, nor epic in and of itself - it is a part of the acceptance criteria for stories. If your DoD contains sufficient security as a requirement, and you have a story that doesn't yet have that security, then the story cannot be considered as 'Done' (and thus burned down) until it meets the DoD requirements.