Now that I updated many of my sites to be HTTPS only, redirecting HTTP requests as needed, I did notice that sharing on Facebook produced a blank image. Refreshing the Share Attachment does not change anything, so I looked into t he FB documentation. It says to specify the og:image:secure tag if your site requires an HTTPS connection, so I replaced the simple og:image tag with the secure one and now the Facebook OpenGraph Debugger says that og:image is missing but there is no longer any unsecure images on this particular site.

Must I really set both? And can they both point to exactly the same HTTPS url?