Browser inspector console log usually display what elements are loaded using unsecure protocol.
The thing is that theme providers are not always the most sharpest tools in the box and sometimes hardcode the protocol (such as http://) to the resources they load (images, fonts, css files and whatnot) to their files. To fix it replace http:// in templates and css files with https:// or even better, use // and allow browser to choose protocol itself.
Tanel Raja
