Ashley
HTTPS server is provided by plugin developers not normal c3 users. For example, I could upload my plugins on github, which is a HTTPS server, too.
Normal user could get a plugin from a link of addon.json like this.
Well... I tried to get addon.json from my github site, but it did not work.
[quote:3nsino85]main.js:2 Refused to connect to 'https://rexrainbow.github.io/C3RexDoc/addons//rex_bbcodeText/addon.json' because it violates the following Content Security Policy directive: "connect-src 'self' blob: wss://signalling.construct.net wss://build.construct.net https://downloads.scirra.com http://localhost:* https://localhost:*".