Depending on what interactions you want, only the origin host would require https. If you need passive mixed content, I believe it is and will remain supported

Depending on what interactions you want, only the origin host would require https. If you need passive mixed content, I believe it is and will remain supported by browsers for some time. If you need active mixed content though you probably will need a workaround via passive content instead.