RedirectDuck team
You move a website to a new domain, configure a redirect and confirm that the destination uses HTTPS. Then someone opens an old bookmark and gets a certificate error.
The missing piece is often the old hostname. When a visitor requests an HTTPS URL, the connection to that hostname must work before the browser can receive the redirect response.
There are two HTTPS connections to consider
For this move:
https://old.example.com/help
→ https://example.com/support
the browser first connects to old.example.com. After receiving the redirect, it connects to example.com. A valid certificate at the second address does not repair a failure at the first.
Check the exact hostnames visitors use. The root domain, www and other subdomains are separate names for DNS and certificate validation.
How RedirectDuck handles the source
RedirectDuck's edge uses Caddy to obtain and renew certificates automatically. Customer hostnames are authorized against the verified domains synchronized to the edge before on-demand issuance is allowed.
There is no fixed issuance-time promise. DNS resolution, domain validation and certificate-authority availability affect when a new hostname can serve HTTPS.
Caddy documents the underlying behavior in its Automatic HTTPS guide. For your domain, the practical check is still an HTTPS request to the old URL.
Verify DNS and HTTPS separately
Use the DNS records shown in the domain's setup instructions, then run verification. Once DNS is resolving as expected, test both forms:
curl -sS -o /dev/null -D - 'http://old.example.com/help'
curl -sS -o /dev/null -D - 'https://old.example.com/help'
Replace these example hostnames with your own. The commands show response headers without following the redirect. Inspect the status and Location header.
Do not disable certificate verification to make the HTTPS check pass. That would conceal the problem a normal visitor is encountering.
Read a failure at the right layer
- A DNS failure means the hostname could not be resolved as expected.
- A TLS error occurs before the browser receives a normal redirect response.
- A 404 can mean the request arrived but no rule matched.
- A correct redirect can still lead to an unavailable destination.
The domain screen records certificate observations, including an expiry date when a certificate has been inspected successfully. These observations complement a live check; they are not a replacement for testing the affected hostname.
Keep the source domain maintained
As long as old HTTPS links need to work, maintain the old domain registration, its DNS setup and its redirect service. Test a small set of saved URLs periodically, including any www or subdomain variants you actually support.
For the setup sequence, see domain forwarding vs DNS and the documentation.
