Can you check where the link to the document points (HTTP or HTTPS)?
I remember this was a problem for me a while ago as the HTTPS service was available everywhere, but HTTP was only accessible behind the firewall and the document links were be encoded with HTTP as the protocol for all instances.
I think the fix is:
Which should use HTTPS as the default protocol for all the links.
zmprov mcf zimbraPublicServiceHostname mail.domain.com
zmprov md domain.com zimbraPublicServiceProtocol https
zmprov md domain.com zimbraPublicServicePort 443
Hope that helps