BahriyaBAHRIYAby Mamluk

TLS and Certificate Errors

A browser warning like "Your connection is not private" or a certificate error means a valid TLS certificate isn't being served for the hostname you're visiting. On the default hostname this is rare; on a custom domain it usually means the certificate hasn't finished provisioning because DNS isn't in place yet.

Updated 3 Aug 20262 min read

A browser warning like "Your connection is not private" or a certificate error means a valid TLS certificate isn't being served for the hostname you're visiting. On the default hostname this is rare; on a custom domain it usually means the certificate hasn't finished provisioning because DNS isn't in place yet.

Symptoms

  • The browser shows a certificate warning or "Not secure" for your hostname.
  • A tool like curl reports a TLS handshake or certificate verification failure.
  • The default hostname works but a newly added custom domain shows a certificate error.

Likely causes

  • The custom domain hasn't been validated yet. Certificates for custom domains are provisioned once the DNS records are in place, which takes a few minutes after the change propagates.
  • DNS isn't pointing correctly. If the record type or target is wrong, the platform can't validate the domain and the certificate never issues. See Custom Domain Not Resolving.
  • The certificate is still provisioning. Immediately after adding a domain there is a short window before the certificate is live.
  • A CDN or proxy in front of the domain is intercepting validation. A proxying provider can block the certificate from being provisioned.
  • You're visiting a hostname the certificate doesn't cover — for example the www variant of an apex domain without WWW redirect enabled.

How to fix

  1. Wait a few minutes. On the default hostname, TLS is provisioned automatically and renewed before expiry. For a new custom domain, allow a short window after DNS propagates for the certificate to issue.
  2. Check your DNS. Confirm the record type and target match your DNS mode (a CNAME for round-robin or geo, A records for none mode). Verify propagation with dig <your-domain> or an online DNS checker. See Setting Up a Custom Domain.
  3. Disable proxying temporarily. If you use a CDN or proxy, turn off proxying so the certificate can be provisioned, then re-enable it once the certificate is live.
  4. Confirm the hostname is covered. For an apex domain that should also serve www, enable WWW redirect so the certificate is extended to cover both.
Heads up

You never need to upload or renew certificates yourself. If a certificate error persists on a domain whose DNS is correct and unproxied, the issue is almost always that DNS validation hasn't completed — recheck the record type and target.