should rel-canonical also include protocol (http/https)?

Question

I'm migrating my website from http to https (although it will still support access via http)

Currently all of my pages have accurate rel-canonical meta tags set in the HTML, but obviously they all point to the canonical http:// url.

Should I now be updating those to https:// too, or is it ok to leave them as http?

I'm wondering whether Google will penalise me, or start detecting duplicate content, if I start mixing them

Answer 1

Yes Google sees http and https as different sites so you should update them.

A redirect on the server might be sufficient in the short term but personally I would be looking to update the pages as soon as you can.