I'd break the site in to two parts, secure and non-secure or if this isn't practical then use relative paths.
If you link to the CSS with a relative path then it'll load over http or https depending on the calling page, if all the images in the CSS are also using relative paths then they to will load over http or https depending on the calling page.
Where you have <img> tags in the page again if they are all using relative paths the images should just load over http or https depending on the calling page.