When I serve all website content from same domain (https://example.com), tools like pingdom keeps yelling: 

> Serve static content from a cookieless domain

When I serve static content from cookie-less domain (http://cdn.example.com), Chrome says: 

> Mixed Content: The page at 'https://example.com/' was loaded over
> HTTPS, but requested an insecure image
> 'http://cdn.example.com/img/xyz.jpg'. This content should also be
> served over HTTPS.

How can I satisfy both conditions at the same time?