docs/comments: Update to secure URL versions

Closes #1741
diff --git a/docs/BINDINGS.md b/docs/BINDINGS.md
index ecd231a..0c65348 100644
--- a/docs/BINDINGS.md
+++ b/docs/BINDINGS.md
@@ -65,7 +65,7 @@
 
 [Object-Pascal](http://www.tekool.com/opcurl) Free Pascal, Delphi and Kylix binding written by Christophe Espern.
 
-[OCaml](http://opam.ocaml.org/packages/ocurl/) Written by Lars Nilsson and ygrek
+[OCaml](https://opam.ocaml.org/packages/ocurl/) Written by Lars Nilsson and ygrek
 
 [Pascal](http://houston.quik.com/jkp/curlpas/) Free Pascal, Delphi and Kylix binding written by Jeffrey Pohlmeyer.
 
@@ -83,7 +83,7 @@
 
 [Rexx](https://rexxcurl.sourceforge.io/) Written Mark Hessling
 
-[Ring](http://ring-lang.sourceforge.net/doc1.3/libcurl.html) RingLibCurl by Mahmoud Fayed
+[Ring](https://ring-lang.sourceforge.io/doc1.3/libcurl.html) RingLibCurl by Mahmoud Fayed
 
 RPG, support for ILE/RPG on OS/400 is included in source distribution
 
@@ -99,7 +99,7 @@
 
 [Smalltalk](http://www.squeaksource.com/CurlPlugin/) Written by Danil Osipchuk
 
-[SP-Forth](http://spf.cvs.sourceforge.net/viewvc/spf/devel/~ac/lib/lin/curl/) Written by Andrey Cherezov
+[SP-Forth](https://sourceforge.net/p/spf/spf/ci/master/tree/devel/~ac/lib/lin/curl/) Written by Andrey Cherezov
 
 [SPL](http://www.clifford.at/spl/) Written by Clifford Wolf
 
diff --git a/docs/CIPHERS.md b/docs/CIPHERS.md
index 99d261b..e09533b 100644
--- a/docs/CIPHERS.md
+++ b/docs/CIPHERS.md
@@ -250,7 +250,7 @@
 
 ## GSKit
 
-Ciphers are internally defined as numeric codes (http://www.ibm.com/support/knowledgecenter/ssw_ibm_i_73/apis/gsk_attribute_set_buffer.htm),
+Ciphers are internally defined as numeric codes (https://www.ibm.com/support/knowledgecenter/ssw_ibm_i_73/apis/gsk_attribute_set_buffer.htm),
 but libcurl maps them to the following case-insensitive names.
 
 ### SSL2 cipher suites (insecure: disabled by default)
diff --git a/docs/FAQ b/docs/FAQ
index 1ab3c0e..5b98106 100644
--- a/docs/FAQ
+++ b/docs/FAQ
@@ -162,7 +162,7 @@
   We pronounce curl with an initial k sound. It rhymes with words like girl
   and earl. This is a short WAV file to help you:
 
-     http://media.merriam-webster.com/soundc11/c/curl0001.wav
+     https://media.merriam-webster.com/soundc11/c/curl0001.wav
 
   There are numerous sub-projects and related projects that also use the word
   curl in the project names in various combinations, but you should take
@@ -366,8 +366,8 @@
   Comprehensible explanations of the meaning of such numbers and how to obtain
   them (resp.) are here
 
-  http://www.bis.doc.gov/licensing/exportingbasics.htm
-  http://www.bis.doc.gov/licensing/do_i_needaneccn.html
+  https://www.bis.doc.gov/licensing/exportingbasics.htm
+  https://www.bis.doc.gov/licensing/do_i_needaneccn.html
 
   An incomprehensible description of the two numbers above is here
   http://www.access.gpo.gov/bis/ear/pdf/ccl5-pt2.pdf
diff --git a/docs/INSTALL.md b/docs/INSTALL.md
index 529a907..6c2c8ce 100644
--- a/docs/INSTALL.md
+++ b/docs/INSTALL.md
@@ -278,8 +278,8 @@
 `USE_LWIPSOCK` preprocessor definition which is for libcurl internals only.
 
 Compilation has been verified with [lwIP
-1.4.0](http://download.savannah.gnu.org/releases/lwip/lwip-1.4.0.zip) and
-[contrib-1.4.0](http://download.savannah.gnu.org/releases/lwip/contrib-1.4.0.zip).
+1.4.0](https://download.savannah.gnu.org/releases/lwip/lwip-1.4.0.zip) and
+[contrib-1.4.0](https://download.savannah.gnu.org/releases/lwip/contrib-1.4.0.zip).
 
 This BSD-style lwIP TCP/IP stack support must be considered experimental given
 that it has been verified that lwIP 1.4.0 still needs some polish, and libcurl
diff --git a/docs/INTERNALS.md b/docs/INTERNALS.md
index a733e1f..2e273a9 100644
--- a/docs/INTERNALS.md
+++ b/docs/INTERNALS.md
@@ -1079,7 +1079,7 @@
 
 [1]: https://curl.haxx.se/libcurl/c/curl_easy_setopt.html
 [2]: https://curl.haxx.se/libcurl/c/curl_easy_init.html
-[3]: http://c-ares.haxx.se/
+[3]: https://c-ares.haxx.se/
 [4]: https://tools.ietf.org/html/rfc7230 "RFC 7230"
 [5]: https://curl.haxx.se/libcurl/c/CURLOPT_ACCEPT_ENCODING.html
 [6]: https://curl.haxx.se/docs/manpage.html#--compressed
diff --git a/docs/KNOWN_BUGS b/docs/KNOWN_BUGS
index 517cd14..1773194 100644
--- a/docs/KNOWN_BUGS
+++ b/docs/KNOWN_BUGS
@@ -380,7 +380,7 @@
 
  libcurl fails to build with MIT Kerberos for Windows (KfW) due to KfW's
  library header files exporting symbols/macros that should be kept private to
- the KfW library. See ticket #5601 at http://krbdev.mit.edu/rt/
+ the KfW library. See ticket #5601 at https://krbdev.mit.edu/rt/
 
 6.3 NTLM in system context uses wrong name
 
diff --git a/docs/libcurl/libcurl-thread.3 b/docs/libcurl/libcurl-thread.3
index 9514d81..c18676e 100644
--- a/docs/libcurl/libcurl-thread.3
+++ b/docs/libcurl/libcurl-thread.3
@@ -53,7 +53,7 @@
 https://curl.haxx.se/libcurl/c/opensslthreadlock.html
 
 .IP GnuTLS
-http://gnutls.org/manual/html_node/Thread-safety.html
+https://gnutls.org/manual/html_node/Thread-safety.html
 .IP NSS
 thread-safe already without anything required.
 .IP PolarSSL
diff --git a/docs/mk-ca-bundle.1 b/docs/mk-ca-bundle.1
index c8f5177..f754e74 100644
--- a/docs/mk-ca-bundle.1
+++ b/docs/mk-ca-bundle.1
@@ -107,7 +107,7 @@
 .SH CERTDATA FORMAT
 The file format used by Mozilla for this trust information seems to be documented here:
 .nf
-http://p11-glue.freedesktop.org/doc/storing-trust-policy/storing-trust-existing.html
+https://p11-glue.freedesktop.org/doc/storing-trust-policy/storing-trust-existing.html
 .fi
 .SH SEE ALSO
 .BR curl (1)
diff --git a/lib/strtoofft.c b/lib/strtoofft.c
index bd3432a..c2adc72 100644
--- a/lib/strtoofft.c
+++ b/lib/strtoofft.c
@@ -29,7 +29,7 @@
  *
  * In the ISO C standard (IEEE Std 1003.1), there is a strtoimax() function we
  * could use in case strtoll() doesn't exist...  See
- * http://www.opengroup.org/onlinepubs/009695399/functions/strtoimax.html
+ * https://www.opengroup.org/onlinepubs/009695399/functions/strtoimax.html
  */
 
 #ifdef NEED_CURL_STRTOLL
diff --git a/packages/Win32/cygwin/README b/packages/Win32/cygwin/README
index 60bb5e1..9a61341 100644
--- a/packages/Win32/cygwin/README
+++ b/packages/Win32/cygwin/README
@@ -40,7 +40,7 @@
 
   (**) LibTool 1.4.2 had a bug related to cygwin's use of ".exe" extensions,
       such that "make install" blew up at curl.exe. See this URL for details:
-         http://mail.gnu.org/pipermail/libtool/2001-September/005549.html
+         https://lists.gnu.org/archive/html/libtool/2001-09/msg00101.html
       The copy of ltmain.sh that is distributed with curl includes this patch.
 
   As of curl 7.9.1, the official source compiles (under Cygwin) and tests
diff --git a/packages/vms/gnv_link_curl.com b/packages/vms/gnv_link_curl.com
index add4be9..64b0aa8 100644
--- a/packages/vms/gnv_link_curl.com
+++ b/packages/vms/gnv_link_curl.com
@@ -262,7 +262,7 @@
 
 For Alpha and IA64 platforms, see the url below to register to get the
 download URL.  The kit will be HP 1.4-467 or later.
-  http://h71000.www7.hp.com/openvms/products/ssl/ssl.html
+  https://h41379.www4.hpe.com/openvms/products/ssl/ssl.html
 
 For VAX, use the same registration, but remove the kit name from any of the
 download URLs provided and put in CPQ-VAXVMS-SSL-V0101-B-1.PCSI-DCX_VAXEXE
diff --git a/src/macos/MACINSTALL.TXT b/src/macos/MACINSTALL.TXT
index ce4d1dc..2bab9fd 100644
--- a/src/macos/MACINSTALL.TXT
+++ b/src/macos/MACINSTALL.TXT
Binary files differ
diff --git a/src/tool_xattr.c b/src/tool_xattr.c
index f49fd57..92b99db 100644
--- a/src/tool_xattr.c
+++ b/src/tool_xattr.c
@@ -42,7 +42,7 @@
   CURLINFO info;
 } mappings[] = {
   /* mappings proposed by
-   * http://freedesktop.org/wiki/CommonExtendedAttributes
+   * https://freedesktop.org/wiki/CommonExtendedAttributes/
    */
   { "user.xdg.origin.url", CURLINFO_EFFECTIVE_URL },
   { "user.mime_type",      CURLINFO_CONTENT_TYPE },
diff --git a/tests/fuzz/curl_fuzzer.c b/tests/fuzz/curl_fuzzer.c
index 2c3d579..2ccf1b3 100644
--- a/tests/fuzz/curl_fuzzer.c
+++ b/tests/fuzz/curl_fuzzer.c
@@ -5,7 +5,7 @@
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
 #
-#      http://www.apache.org/licenses/LICENSE-2.0
+#      https://www.apache.org/licenses/LICENSE-2.0
 #
 # Unless required by applicable law or agreed to in writing, software
 # distributed under the License is distributed on an "AS IS" BASIS,
diff --git a/tests/runtests.pl b/tests/runtests.pl
index 3d90789..065df7c 100755
--- a/tests/runtests.pl
+++ b/tests/runtests.pl
@@ -4952,7 +4952,7 @@
                     return "failed starting socks5 server";
                 }
                 elsif(($sshdid =~ /OpenSSH/) && ($sshdvernum < 370)) {
-                    # Need OpenSSH 3.7 for socks5 - http://www.openssh.com/txt/release-3.7
+                    # Need OpenSSH 3.7 for socks5 - https://www.openssh.com/txt/release-3.7
                     logmsg "$sshdverstr insufficient; socks5 tests need at least OpenSSH 3.7\n";
                     return "failed starting socks5 server";
                 }
diff --git a/tests/unit/unit1604.c b/tests/unit/unit1604.c
index f2d791d..b414e03 100644
--- a/tests/unit/unit1604.c
+++ b/tests/unit/unit1604.c
@@ -9,7 +9,7 @@
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
- * are also available at http://curl.haxx.se/docs/copyright.html.
+ * are also available at https://curl.haxx.se/docs/copyright.html.
  *
  * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  * copies of the Software, and permit persons to whom the Software is