Embedding Metabase - the content must be served over HTTPS

In my localhost (http) embedded metabase dashboard just works fine, but when I try it on production (https) I get this console error:

Mixed Content: The page at 'https://my-production-domain.com/' was loaded over HTTPS, but requested an insecure resource 'http://my-metabase-domain.com/embed/dashboard/myjwttoken#bordered=true&titled=true'. This request has been blocked; the content must be served over HTTPS

PHP:

$key = 'my_secret_key';
$url = 'http://my-metabase-domain.com';

$resource = array(
    'dashboard' => 5
);
$params = array(
    'user_id' => null
);

$token = (new Builder())
    ->set('resource', $resource)
    ->set('params', $params)
    ->sign(new Sha256(), $key)
    ->getToken();

In HTML:

<script src="<?php echo $url; ?>/app/iframeResizer.js"></script>
<iframe src="<?php echo $url; ?>/embed/dashboard/<?php echo $token; ?>#bordered=true&titled=true" frameBorder="0" width="100%" allowTransparency onload="iFrameResize({}, this)"></iframe>