The .htaccess file included with Blesta already contains a rule to force HTTPS, which is commented out by default. Simply remove the # symbol at the beginning of these lines
# Force HTTPS
#RewriteCond %{HTTPS} !=on
#RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=307,NE,L]
i.e.
# Force HTTPS
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=307,NE,L]