As I write this post on 12 Oct, The FBML apps I manage are all working fine even without SSL certificate. Facebook’s Secure Page URL requirement by Oct 1, 2011 mentioned on this Facebook Platform road map page had created some anxious moments for many developers earlier.
On the the above road map for developers web page under this, Apps on Facebook Authentication and security migration (HTTPS).
All Canvas and Page tab apps (that are not using FBML). This requirement is for iFrame apps. So FBML apps are not required to migrate to SSL but only as yet because by June 1, 2012, all apps need to migrate to iFrame.
June 1, 2012
1. FBML Deprecation
FBML apps will no longer work on Platform. All FBML endpoints are removed as of June 1, 2012
Which means FBML apps will stop working on June 1, 2012. By then all apps need to migrate to iFrame and which will mean you will also need SSL on your domain.