[latortuga]

Yes, absolutely 100% yes an SSL certificate is still required. Look up mixed content warnings and why they're a bad thing.

[ceejayoz]

You get a mixed-content warning for HTTP on HTTPS, but not HTTPS on HTTP as you're already insecure on the original page anyways.