I'm working on forcing SSL connections to the MODX manager - I wrote this up:
http://rtfm.modx.com/display/revolution20/Hardening+MODX+Revolution#HardeningMODXRevolution-ForcingSSLconnectionstotheManager
However I noticed that browsers don't give a full green light to the manager when accessed via HTTPS because some of the other assets (images, CSS, JS, etc.) are still being pulled up via HTTP. The "server_protocol" System Setting would override the protocol for the ENTIRE site, but really I just need to change the protocol for the MANAGER.
Anyone done this? I think there may be 2 feature requests here:
1. A separate System Setting for the manager protocol
2. Rewrite the manager template files to use the double forward slashes (e.g. "//assets/my.js") so that the protocol is inherited. That would mean that if you force connections to your manager to occur over 443 HTTPS, that the assets would also load up via HTTPS and the browser wouldn't complain.
☆ A M B ☆