Yes.

Exactly.

End Users are not related to $secretTuringPass at all. It is used in the coding process only, the image itself could be displayed only using <img> tag, images can not be embedded in HTML directly. That's why while referring to the image containing a certain code, PHP generates some encoded string for this and uses sophisticated protection password to not allow this string easily decoded with brute-force method and others. $secretTuringPass is just about making the public URL to the image a unique one. Without knowing this value, the actual code on the Captcha image could not be known to decoding machine, if it doesn't know the secret key.

Not sure if it's a bug, but on the registration page the link to the captcha-code is http where the rest of my website is https. This leads to the problem that the code is not shown.

Ref. MiniBB ver 3.3, addon_captcha_options.php, $actual_link

Not sure what the $actual_link is about (?), but addon_captcha_options.php, there's an option named $urlToTuringImage. There you should change http to https and that way it should work.

There's a standalone option, because the image is loaded independently from the forum options. So if you change $main_url in setup_options.php (for example, when switching to https), then if you have the Captcha add-on installed, you also need to change $urlToTuringImage.

It is about this:

$actual_link = "http://$_SERVER[HTTP_HOST]$_SERVER[REQUEST_URI]";
$xc=explode('/', $actual_link);
unset($xc[sizeof($xc)-1]);
$fullPath=implode('/', $xc).'/';
$urlToTuringImage=$fullPath.'addon_captcha.php';

I was just surprised to find 'http' hard coded in the code instead of a variable, but of course I got it working after adding an 's' to http in $actual_link. Indeed the problem occured after we switched to https. This would work:

$urlToTuringImage=$main_url.'/'.'addon_captcha.php';

When describing the problem, you have to mention you're using the Compiler's version :) because the default add-on has more simpler setup, the one I described.

So either you could substitute https in the code for $actual_link, either just remove all automatic code which Compiler provides, replacing it to the code I've described above. You may need to check default addon_captcha_options.php to see what I'm about.

$main_url won't work here. The script which displays the Captcha image, is standalone and it doesn't rely on setup_options.php where this option comes from.