figured it out... apparently I can do this:
SSLProxyEngine On
RequestHeader set Front-End-Https "On"
ProxyPass / https://win.acme.com/
ProxyPassReverse / https://win.acme.com/
CacheDisable *
and it works just fine!
[the solution came from mikeg's posting on 3cx.org]