For the sake of full disclosure and clarity, though - you can do http on your primary page, and iframe source can be either http or https. If you use https on your primary page, you must use https on iframe. However, for the sake of security you should try and use https every time you can.

So, just wanted to point out the difference between can and must - you can use http but you really must use https.