I'd say definitely put Denny's iRule in place on the port 80 virtual to redirect those beginning @ an http URL and minimize the likelihood of warnings overall.
However, if the cert is for host.site.org, clients are still always going to get the cert mismatch warning if they browse to https://host.site.com, because as Denny hints, the hostname that was requested is not visible until after the handshake completes, so the warning would already have been displayed in the browser by the time the iRule could decide to send a redirect.
/deb
Nimbostratus