Comment by elchief

Don't forget to disable TLS compression and HTTP compression for pages containing session ids or CSRF tokens.

Basically you need a cookie-less HTTPS subdomain for your static media, and a www.example.com HTTPS domain for your content.