When I serve all website content from same domain (https://example.com), tools like pingdom keeps yelling:
Serve static content from a cookieless domain
When I serve static content from cookie-less domain (http://cdn.example.com), Chrome says:
Mixed Content: The page at '
https://example.com/' was loaded over HTTPS, but requested an insecure image 'http://cdn.example.com/img/xyz.jpg'. This content should also be served over HTTPS.
How can I satisfy both conditions at the same time?
When I serve static content from cookie-less domain (
http://cdn.example.com)
Just as the message says... Your "cookie-less domain" also needs to be HTTPS. eg. https://cdn.example.com.
Once you switch to HTTPS then everything must switch to HTTPS. It's all or nothing. This is for a reason... If you have resources on a non-secure HTTP connection then it is possible that "information" could be leaked over this non-secure connection and intercepted, which kind of defeats the point of having HTTPS in the first place.
Cookie: headers (that are associated with your main site) is avoided. However, bear in mind, that you can't use a subdomain like cdn.example.com as a cookie-less domain, if you are using the apex domain (eg. example.com) for you main site. You would need to use www.example.com (for example). (One of the advantages of www over non-www.)
mysupercdn.net, then the mixed content warning would disappear?
https://mysupercdn.net (note the HTTPS). The Mixed content warning is because you have both HTTPS (secure) and HTTP (non-secure) content on the same page.
*.example.com, therefore there are cookies being set for every subdomain. Is that right?