TBH I'm not sure how you managed to get the DNS pointing to both of the appliances as that shouldn't be possible within the Hub. But sounds like you managed! :) Anyway, the DNS won't actually resolve to both of them (even if it appears that it does). Once you have destryed the undesired one then you'll need to check the DNS. Hopefully the Small instance had the DNS; otherwise you will need to wait for that to resolve.

HTTPS is already enabled. The reson why you are getting the warning is because by default TKL servers use what is called a "self-signed" certificate. THey are good because you can make them yourself and they are free. However because they are self-signed there is no authority that your server is what it says it is. So if you want to remove that warning then you'll need to purchase a certificate (that matches your domain name) from a third party certificate authority (CA). Web browsers already trust these third party CAs so any certificates issued by them should work...

It's a bit of a process but is fairly well documented around the net and usually CAs have detailed instructions on how to install new certificates. ZIf you keep in mind that TurnKey is built on Debian and the Moodle appliance uses the Apache webserver you should be able to find tons of info via google (something like "debian apache install ca cert" should give plenty of results).