Index: wp-includes/class-wp-customize-control.php
===================================================================
--- wp-includes/class-wp-customize-control.php	(revision 20826)
+++ wp-includes/class-wp-customize-control.php	(working copy)
@@ -343,7 +343,7 @@
 						<?php if ( empty( $src ) ): ?>
 							<img style="display:none;" />
 						<?php else: ?>
-							<img src="<?php echo esc_url( $src ); ?>" />
+							<img src="<?php echo esc_url( set_url_scheme( $src ) ); ?>" />
 						<?php endif; ?>
 						<div class="dropdown-status"></div>
 					</div>
@@ -426,7 +426,7 @@
 
 		foreach ( $headers as $header ) : ?>
 			<a href="#" class="thumbnail" data-customize-image-value="<?php echo esc_url( $header['url'] ); ?>">
-				<img src="<?php echo esc_url( $header['thumbnail_url'] ); ?>" />
+				<img src="<?php echo esc_url( set_url_scheme( $header['thumbnail_url'] ) ); ?>" />
 			</a>
 		<?php endforeach;
 	}
@@ -437,7 +437,7 @@
 
 		foreach ( $custom_image_header->default_headers as $header ) : ?>
 			<a href="#" class="thumbnail" data-customize-image-value="<?php echo esc_url( $header['url'] ); ?>">
-				<img src="<?php echo esc_url( $header['thumbnail_url'] ); ?>" />
+				<img src="<?php echo esc_url( set_url_scheme( $header['thumbnail_url'] ) ); ?>" />
 			</a>
 		<?php endforeach;
 	}
Index: wp-includes/customize-controls.php
===================================================================
--- wp-includes/customize-controls.php	(revision 20826)
+++ wp-includes/customize-controls.php	(working copy)
@@ -92,13 +92,27 @@
 
 	do_action( 'customize_controls_print_footer_scripts' );
 
+	// If the frontend and the admin are served from the same domain, load the
+	// preview over ssl if the customizer is being loaded over ssl. This avoids
+	// insecure content warnings. This is not attempted if the admin and frontend
+	// are on different domains to avoid the case where the frontend doesn't have
+	// ssl certs. Domain mapping plugins can force ssl in these conditions using
+	// the customizer_preview_link filter.
+	$admin_origin = parse_url( admin_url() );
+	$home_origin = parse_url( home_url() );
+	$scheme = null;
+	if ( is_ssl() && ( $admin_origin[ 'host' ] == $home_origin[ 'host' ] ) )
+		$scheme = 'https';
+
+	$preview_url = apply_filters( 'customizer_preview_link',  home_url( '/', $scheme ) );
+
 	$settings = array(
 		'theme'    => array(
 			'stylesheet' => $this->get_stylesheet(),
 			'active'     => $this->is_current_theme_active(),
 		),
 		'url'      => array(
-			'preview'  => esc_url( home_url( '/' ) ),
+			'preview'  => esc_url( $preview_url ),
 			'parent'   => esc_url( admin_url() ),
 			'ajax'     => esc_url( admin_url( 'admin-ajax.php', 'relative' ) ),
 		),
Index: wp-includes/link-template.php
===================================================================
--- wp-includes/link-template.php	(revision 20826)
+++ wp-includes/link-template.php	(working copy)
@@ -2198,6 +2198,36 @@
 }
 
 /**
+ * Set the scheme for a URL
+ *
+ * @since 3.4.0
+ * 
+ * @param string $url Absolute url that includes a scheme
+ * @param string $scheme Optional. Scheme to give $url. Currently 'http', 'https', 'login', 'login_post', 'admin', or 'relative'.
+ * @return string $url URL with chosen scheme.
+ */
+function set_url_scheme( $url, $scheme = null ) {
+	$orig_scheme = $scheme;
+	if ( ! in_array( $scheme, array( 'http', 'https', 'relative' ) ) ) {
+		if ( ( 'login_post' == $scheme || 'rpc' == $scheme ) && ( force_ssl_login() || force_ssl_admin() ) )
+			$scheme = 'https';
+		elseif ( ( 'login' == $scheme ) && force_ssl_admin() )
+			$scheme = 'https';
+		elseif ( ( 'admin' == $scheme ) && force_ssl_admin() )
+			$scheme = 'https';
+		else
+			$scheme = ( is_ssl() ? 'https' : 'http' );
+	}
+
+	if ( 'relative' == $scheme )
+		$url = preg_replace( '#^.+://[^/]*#', '', $url );
+	else
+		$url = preg_replace( '#^.+://#', $scheme . '://', $url );
+
+	return apply_filters('set_url_scheme', $url, $scheme);
+}
+
+/**
  * Get the URL to the user's dashboard.
  *
  * If a user does not belong to any site, the global user dashboard is used. If the user belongs to the current site,
Index: wp-admin/custom-header.php
===================================================================
--- wp-admin/custom-header.php	(revision 20826)
+++ wp-admin/custom-header.php	(working copy)
@@ -333,7 +333,7 @@
 			$width = '';
 			if ( !empty( $header['attachment_id'] ) )
 				$width = ' width="230"';
-			echo '<img src="' . $header_thumbnail . '" alt="' . esc_attr( $header_desc ) .'" title="' . esc_attr( $header_desc ) . '"' . $width . ' /></label>';
+			echo '<img src="' . set_url_scheme( $header_thumbnail ) . '" alt="' . esc_attr( $header_desc ) .'" title="' . esc_attr( $header_desc ) . '"' . $width . ' /></label>';
 			echo '</div>';
 		}
 		echo '<div class="clear"></div></div>';
