Favicon is located in the header.php but the code for getting the url is
<link rel="shortcut icon" type="image/x-icon" href="<?php echo get_theme_mod_not_empty('favicon', TEMPPATH.'/images/favicon.png');?>" />
It’s pulling the option from the customizer to show the favicon. This however is obsolete in wordpres 4.3.1, since you put your favicon by putting the ‘Site Identity’. So that should be over https.
Logos are located in partials folder in header_layout_ files. But they are all pulled from customizer, so they should also be governed by wordpress.
$header_logo = get_theme_mod('header_logo', '');
<img id="main_logo" src="<?php echo $header_logo;?>" alt="<?php bloginfo('name');?>">
As you can se we only call the native wordpress functions. We never specify the protocol.
