There is a problem with Facebook applications/page tabs and Chrome/Internet Explorer users that have checked “secure browsing” setting in their profile but not only.
Problem rises when facebook opens our app by https protocol. Let’s assume that we have app and all our resourcess accessbile by https. When user visits our app, everything working but not iframe/JS widgets, provided by external sites without SSL like some counters, instant messaging widget etc.
What to do if the page where widget comes from doesn’t let us to generate ssl-version code, and also just changing http to https doesn’t work because of lack of certificates/ssl enabled etc ?
Basically what the “padlock”/SSL indicator in the browser indicates is that the whole page is secure.
That means, no insecure content is included on the page without explicit warning by the browser that that is the case.
There may be browser specific workarounds (aka bugs), but relying on them for your page to work is not a good idea.
The best “workaround” is likely to just contact the people hosting the widgets and inform them about your problem, or if possible just plain hosting the widgets on your own secure site.