If you're pulling in images on the checkout page, you can just use root-relative urls (ex: /images/mypicture.jpg). The root changes from http://www.yoursite.com to https://www.yoursite.com, so the images are secure.

Live support. If your app is on the same domain, you can also use the root-relative urls. If it is on a different domain, you'd want to make sure that other domain can serve secure pages, then call it with https://whatever to ensure it is secure. But that might throw some warnings for some browsers since your calling elements from two different domains... not sure. If you have to have the apps on a different machine, a sub-domain of your main domain would probably be least likely to throw any warnings (ex: subdomain.mysite.com), but you'd still need an ssl cert on the subdomain.