WP-Juicebox defines the path to the configUrl as an absolute URL.
As such, it does not rely on the 'juicebox.js' file to build up an absolute URL from a relative one.
Also, the absolute URL used to define the path to the configUrl within WP-Juicebox does not hardcode the 'http://' part.
It is constructed from the following code using the WordPress method wp_upload_dir(). If your WordPress installation is hosted on a secure server, then I would expect the method to return a URL starting with 'https://'.
$upload_dir = wp_upload_dir();
$gallery_filename = $upload_dir['baseurl'] . '/juicebox/' . $gallery_id . '.xml';
However, this does not seem to be the case. (I do not have a secure server on which to test.)
Try inserting the following code on line 1083 of 'wp-juicebox.js'.
if (strpos($gallery_filename, 'http') === 0 && is_ssl()) {
$gallery_filename = str_replace('http://', 'https://', $gallery_filename);
}
Hopefully, this will resolve the issue and the fix can be included in the next version of WP-Juicebox.
Thank you for reporting.