When I serve all website content from same domain (`https://example.com`), tools like pingdom keeps yelling: 

> Serve static content from a cookieless domain

When I serve static content from cookie-less domain (`http://cdn.example.com`), Chrome says: 

> Mixed Content: The page at '`https://example.com/`' was loaded over
> HTTPS, but requested an insecure image
> '`http://cdn.example.com/img/xyz.jpg`'. This content should also be
> served over HTTPS.

How can I satisfy both conditions at the same time?