Sorry. The connection is vulnerable, not the server.
And you don’t know if there is a certificate on the server or not. Serving content via HTTP doesn’t mean that SSL is not supported or that there’s no cert installed. If he uses “Flexible SSL”, the connection between Cloudflare stays unencrypted. Not the best option at all, but it was build for easy usage.
Currently there’s mixed content. Nothing more. So “Always use HTTPS” should solve this.