Now that I updated many of my sites to be HTTPS only, redirecting HTTP requests as needed, I did notice that sharing on Facebook produced a blank image. Refreshing the Share Attachment does not change anything, so I looked into t he FB documentation. It says to specify the *og:image:secure_url* tag if your site requires an HTTPS connection, so I *replaced* the simple *og:image* tag with the secure one and the Facebook OpenGraph Debugger says that *og:image* is missing but the site no longer has any unsecure images.

**Must I really set both? And can they both point to exactly the same HTTPS url?**