Redirect works on http but not https: why and how to fix it

Why https fails when http works

A redirect is a response from a server. To get any response over https://, the browser first has to set up a secure connection. For that, the server must present a valid certificate for the exact domain being visited.

So the order is:

1. The browser connects to the server for olddomain.com.

2. It asks for a certificate that covers olddomain.com.

3. Only if that works does it send the request and receive the redirect.

If step 2 fails, the browser stops with a certificate error. The redirect never runs.

Over http://, there’s no step 2, which is why the plain version works.

Why it’s more common than it looks

You might think people rarely type https://. But most of the time, they don’t type at all:

• Search results and backlinks for a site that used HTTPS point to https://.

• Browsers remember that a site used HTTPS and try it first.

• Some browsers now try https:// by default for every address.

• Domains on HSTS lists, including all .dev and .app domains, are always loaded over HTTPS.

So if the old domain ever had a secure website, most real visits arrive over https://.

Where it usually goes wrong

• Registrar forwarding without certificates. Some registrars only forward over HTTP, or only under certain conditions. We cover one example in why your Namecheap redirect doesn’t work over HTTPS.

• The old hosting was cancelled. The certificate lived on the old server. Without it, nothing can answer securely.

• The certificate doesn’t cover www. https://olddomain.com works, https://www.olddomain.com doesn’t.

• The certificate expired. It was renewed by the old host, which no longer does that job.

How to fix it

Whatever answers for the old domain needs a valid certificate for it, renewed automatically. You have three options:

1. Use a redirect service that issues certificates. Redirect Supply issues and renews them for every connected domain, covering both the bare domain and www.

2. Keep hosting with SSL for the old domain. It works, but you keep paying for a server just to send redirects.

3. Use a CDN that terminates SSL, such as Cloudflare with the domain proxied, and set the redirect there.

Why you can’t just skip HTTPS

It can be tempting to tell people to use http:// instead, or to hope few visitors arrive over https://. That doesn’t work for long.

Browsers increasingly upgrade visits to https:// automatically. Search engines keep the https:// URLs they indexed. And for domains on the HSTS preload list, browsers refuse plain HTTP entirely. Fixing the certificate is the only reliable answer.

How to check it’s fixed

Use our redirect tester with the Both option. It runs the redirect from http:// and https:// and shows each result side by side.

Test both the bare domain and www. If you use Redirect Supply and the certificate isn’t ready yet, see SSL certificate issues.

A quick rule to remember

If a domain ever had HTTPS, its redirect needs HTTPS too, for as long as people might visit it. Treat the certificate as part of the redirect, not an extra.