Figured this one out!
Looks like the playback controls are hard-coded to operate on the HTTP port configured in the NVR, whether or not you're logging in via HTTPS. When I began forwarding both the HTTPS and HTTP ports through the firewall, playback and live view worked! So, HTTPS is used...