Not working for subdmains - blocked by chrome/firefox because of http instead of https

When loading from xxx.test toolbar links are using https but when using domain admin.xxx.test debug toolbar is using http for loading assets and both browsers chrome and firefox are now blocking by default under https loading http.

SERVER_NAME: 'xxx.test'
PREFERRED_URL_SCHEME = "https"

register subdomain blueprint
app.register_blueprint(
bp,
url_prefix='/',
subdomain=admin
)

Firefox URL https://admin.xxx.test
Blocked loading mixed active content "http://xxx.test/_debug_toolbar/static/js/jquery.js"
home
Loading failed for the <script> with source “http://xxx.test/_debug_toolbar/static/js/jquery.js”. home:239:1
Blocked loading mixed active content "http://xxx.test/_debug_toolbar/static/js/jquery.tablesorter.js"
home
Loading failed for the <script> with source “http://xxx.test/_debug_toolbar/static/js/jquery.tablesorter.js”. home:240:1
Blocked loading mixed active content "http://xxx.test/_debug_toolbar/static/js/toolbar.js"
home
Loading failed for the <script> with source “http://xxx.test/_debug_toolbar/static/js/toolbar.js”.

Chrome URL https://admin.xxx.test
Mixed Content: The page at 'https://admin.xxx.test/login' was loaded over HTTPS, but requested an insecure script 'http://xxx.test/_debug_toolbar/static/js/jquery.js'. This request has been blocked; the content must be served over HTTPS.
login:1 Mixed Content: The page at 'https://admin.xxx.test/login' was loaded over HTTPS, but requested an insecure script 'http://xxx.test/_debug_toolbar/static/js/jquery.tablesorter.js'. This request has been blocked; the content must be served over HTTPS.
login:1 Mixed Content: The page at 'https://admin.xxx.test/login' was loaded over HTTPS, but requested an insecure script 'http://xxx.test/_debug_toolbar/static/js/toolbar.js'. This request has been blocked; the content must be served over HTTPS.

Reproduce the issue with SERVER_NAME set to xxx.test, PREFERRED_URL_SCHEME set to https, and the toolbar registered on the admin subdomain. Trace how the debug toolbar builds its asset URLs for a subdomain request and verify the generated scripts use HTTPS, then confirm the assets load without mixed-content errors in Chrome or Firefox.