In the update manifest delivered from the updateURL the updateLink must be specified in one of the following ways:
The updateLink to the XPI file must use https
The updateLink can use http and you must include an updateHash for the XPI file using sha1, sha256, sha384 or sha512 hash algorithms.