You can try sniffing traffic to/from the server (e.g. tcpdump, wireshark) and look for URLs there. That probably won't help with the port 443 traffic (though the amount of traffic will tell you a little about how popular the server is and maybe even how it's used or what it does (streaming-shaped traffic, regular (automated) queries and in which direction, etc.), and may give you a list of people to target to find out more about the server), and will only work if you manage to get "between" the server and hosts communicating with it (e.g. if you have freedom to plug into different ethernet ports); it also requires someone else to be actively using the server.
Depending on what sort of network access you have, you can look for references to the web server in other communications (e.g. search users' emails for URLs at that server, or find references to it in online documentation or SharePoint/wikis/newsletters (every intranet that gets big enough re-invents its own internal version of Google, just so its authorized users can find what they need)).
If you can get access to the server itself you can look at the webroot (and other web directories like ~/public_html) to see what files are hosted there. If it uses an outdated OS or Apache version you may be able to exploit known bugs to gain access.
other than guessing: you can try to find a list of common URLs, which is a sort of targeted guessing. But a URL that no one accesses or talks about, and that you don't have access to on the server itself, will stay hidden.