Loading TinyMCE over HTTPS, yet CSS files are loaded over HTTP and Chrome stops it

I’ve downloaded a “custom” zip of tinymce, and un-zipped it in a subdirectory of my server. I do not use the TinyMCE CDN, because I’ll be integrating this into an app that manages cross-domain issues. The hosting page, and the tinymce script, are served over HTTPS. However, after doing that, the script turns around and attempts to load two CSS files over HTTP, which Chrome blocks, which causes the load to fail and the editor to not appear.

I’ve tried configuring for https, but it doesn’t seem to “take.”

Here’s how I initialize it:

    var baseurl = document.location.protocol + "//" + document.location.host + "/(removed)/tinymce";
    tinymce.init({
        'selector': '#stencils_temp',
        width: 960,
        height: 800,
        relative_urls: true,
        remove_script_host: true,
        document_base_url: baseurl,
        protocol: 'https',
        plugins: 'advlist autoresize charmap colorpicker emoticons hr link nonbreaking paste tabfocus textcolor visualchars anchor code contextmenu image insertdatetime lists noneditable preview searchreplace table wordcount autolink directionality fullscreen imagetools media pagebreak print spellchecker template visualblocks'
    });

(The same problem happens with only the selector: configuration)

Here are the errors I get:

(index):1 Mixed Content: The page at ‘https://(removed)/stencils/’ was loaded over HTTPS, but requested an insecure stylesheet ‘http://(removed)/tinymce/skins/lightgray/skin.min.css’. This request has been blocked; the content must be served over HTTPS.

(index):1 Mixed Content: The page at ‘https://(removed)/stencils/’ was loaded over HTTPS, but requested an insecure stylesheet ‘http://(removed)/tinymce/skins/lightgray/content.min.css’. This request has been blocked; the content must be served over HTTPS.

[jwatte]

The problem for me was that an unrelated error caused a redirect to an insecure version of the page.

[merwok]

FWIW, protocol-relative URLs are valid (e.g. script src="//cdn.example.com/file.js"), but it’s simpler to always have https URLs given that both http and https pages can load https resources.