HTTPS forwarding needs a valid certificate for the source hostname before the browser can receive its redirect. A certificate on the destination website does not cover the forwarding domain. Inspect both the recorded certificate state and the certificate the public runtime actually presents.
| Method | Resource | Scope | Idempotency-Key |
|---|---|---|---|
GET |
/v2/forwarding/domains/{domainId}/certificates |
forwarding:read |
Not required by this route |
POST |
/v2/forwarding/domains/{domainId}/certificates/renew |
forwarding:deploy |
Required |
IN THIS ARTICLE
01 Check the current certificate
- Read the owned forwarding domain and confirm its HTTP runtime assignment and ownership verification.
- List its certificate records, following pagination. Compare names, status, validity dates and recorded errors where returned.
- Check that each enabled source hostname resolves to the intended runtime. Include
wwwwhen the rule serves it. - Open an HTTPS connection to the source and inspect the actual certificate names, issuer, validity and chain. Check the exact failing hostname rather than only the destination site.
- Review DNS and any CAA policy required for the configured certificate issuer. Correct stale records or validation reachability before requesting renewal.
02 Request renewal
POST to certificates/renew with forwarding:deploy and a unique idempotency key. Save the returned work reference, inspect its final outcome and then repeat the public TLS test.
A queued request is not an issued certificate, and a new certificate record is not proof that every runtime node has loaded it. If the recorded state looks healthy but the browser still sees an expired certificate, inspect routing, alternate addresses and the deployed generation.
Common questions
Why does HTTP redirect successfully while HTTPS fails?
The HTTPS handshake happens before the redirect response. The source needs its own valid certificate and a runtime listening on the appropriate TLS endpoint.
Does a wildcard redirect automatically include a wildcard certificate?
Do not assume it does. Host matching, certificate names and the runtime's supported validation method are separate capabilities. Confirm the coverage actually issued for your service.
Should I keep forcing renewal?
First resolve the reported validation or runtime error. Repeated requests cannot fix incorrect DNS or ownership and may consume issuer or service limits. Retain the original operation evidence while troubleshooting.
Is this the same as a registration certificate?
No. TLS certificates secure connections to a hostname. The module's branded domain registration certificate records registration facts and has a separate verification workflow.