In our environment, everything is configured for developing, deploying and using SharePoint apps. (Internal only).
A separate app-domain, an empty host header web application to receive all traffic to port 443, and a wildcard certificate for the app domain. The Cname/Alias for the apps is pointing to the SharePoint web front server FQDN (we only have one WFE for the moment in each farm) and the service applications are all set up and apps deploys and displays correctly.
SSL for apps work when you go to the app instance itself and i can see that the certificate is getting loaded correctly, but this is a bit shaky so sometimes the cert loads instantly, other times after an additional page refresh (F5).
Embedding an app in a SharePoint page breaks the SSL. The only thing i can find through FireFox is that the app certificate can't load with a very general error message.
The certificate is not trusted because the issuer certificate is unknown. The server might not be sending the appropriate intermediate certificates. An additional root certificate may need to be imported.
Are there any trust that needs to be configured because of the apps running from a separate domain? Do all the certificates needs to be added to SharePoints trusted cert store?
I've used fiddler and F12 developer tools in Chrome, IE, Firefox and Opera to see if there are anything that uses HTTP and breaks SSL but i have yet to found any element or reference that could be causing the issue.