Why you see “Your connection is not private” when redirecting
The handshake happens before the redirect does, so a domain that only forwards traffic still needs a certificate in its own name. What the warning means and how to clear it.
You set up a redirect, you type the domain, and instead of being forwarded you get a full-page warning: “Your connection is not private” in Chrome, “Warning: Potential Security Risk Ahead” in Firefox, “This Connection Is Not Private” in Safari.
The security check happens before the redirect does
A secure request has two stages. First the browser opens a secure connection to whatever address the domain points at, and the server presents a certificate for the name the visitor typed. The browser checks that certificate. Only if it passes does the browser ask for the page and read the response — and your redirect is the response.
What the browser is objecting to
Chrome shows a code at the bottom of the warning. It tells you which of these it is.
| What you see | What it means |
|---|---|
ERR_CERT_COMMON_NAME_INVALID |
The server had a certificate, just not one listing the name you typed — usually because the domain points at somebody else’s server. |
ERR_CERT_DATE_INVALID |
The certificate has expired. Or your own device’s clock is badly wrong, which makes every certificate on the internet look invalid. |
ERR_CERT_AUTHORITY_INVALID |
Someone generated a certificate instead of obtaining one from an authority browsers already trust. Self-signed certificates are fine on your own laptop and useless in public. |
| “Took too long to respond” | Not a certificate problem at all — nothing is answering securely at that address. Worth telling apart before you start replacing certificates. |
Why this shows up now and did not used to
The old assumption was that nobody types https:// in front of an old domain, so a plain HTTP
redirect was enough. That has not been true for years.
Current versions of Chrome, Firefox and Safari try HTTPS first for anything typed into the address bar, and
only fall back to HTTP if that fails — some configurations do not fall back at all. On top of that, every link
to your old domain from a search result, another site, a social card or an email signature written in the last
several years is likely to be an https:// link. Your visitors are not choosing HTTP even when they
think they are.
HSTS makes the warning permanent
HSTS is a setting a site can send that tells browsers: for this hostname, never use plain HTTP again. Browsers take it seriously and remember it.
Two consequences matter here:
- Once a browser holds an HSTS entry for your domain, it will not even try the HTTP version — so an HTTP-only redirect becomes unreachable for that visitor.
- On an HSTS-pinned hostname the warning has no “proceed anyway” link. The click-through is deliberately removed.
Redirecting does not exempt you
The certificate has to be for the source domain — the name in the address bar when the warning appears. The destination’s certificate is a separate matter, checked only after the browser has followed the redirect.
Which gives you two places a warning can come from:
- The source has no valid certificate, so visitors never reach the redirect at all.
- The source is fine, but it points at an
https://destination whose own certificate is broken — so they get the same warning one hop later, on a site you may not control.
How to clear it
Point the domain’s A record at us and the certificate stops being your problem. We obtain one for the domain
from Let’s Encrypt, install it, and renew it automatically for as long as the domain points at us. The
www version is covered free alongside the root, which handles the most common version of the
name-mismatch case above. The free plan covers one domain, and needs no credit card.
Checking afterwards
Open the domain in a private or incognito window. You should be forwarded to your destination with a padlock in the address bar and no warning. Click the padlock to see who issued the certificate and when it expires.
Tools we recommend
- SSL Checker (opens in a new tab) Enter your domain and it reports who issued the certificate, which names it covers, when it expires and whether the chain is complete — the same things the browser is checking.
-
whatsmydns.net
(opens in a new tab)
If the certificate looks right but the warning persists, check the domain is not still answering with an
old address somewhere. Choose A and look for
47.206.179.19.
If the warning survives all of that, check that the domain is not still resolving to its old address somewhere, and that no second A or AAAA record is sending a share of your visitors to a server that knows nothing about your certificate.
If you are comfortable with a terminal Optional — the padlock shows most of this
Ask for the headers, and look for a redirect rather than a certificate error:
curl -sI https://example.comTo inspect the certificate itself — who issued it, which names it covers, when it expires:
openssl s_client -connect example.com:443 -servername example.comReady to set this up?
The free plan covers one domain, certificate included. No credit card required.