Main Issue

As long as you are accessing the WordPress dashboard via HTTPS, new media items should be inserted into content using HTTPS in the associated media item URL. There is a bit more detail around that feature in this WordPress ticket: wp_get_attachment_url returns https when it should not.
That ticket describes how wp_get_attachment_url returns URL’s that are protocol relative following an update in version 4.2. Following the related changes made editing any post and using wp_get_attachment_url to pull in URL’s will use HTTPS.

Using relative paths for resources is another viable option, but since WordPress has various pieces of functionality that specify a full path, it seems easier to skip that option.

How to Correct

To correct any old references to HTTP URL’s, I would recommend using the various tools available to execute a “search and replace” across all posts/content in your site’s database. You would essentially be searching for http://domain.com/.... and replacing it with https://domain.com/.... My personal preference is interconnectit’s serach and replace tool: https://interconnectit.com/products/search-and-replace-for-wordpress-databases/

However wp-cli is another solid option. Also you can go the plugin route with something like Velvet Blues.