SSL Redirection: How to redirect with HTTPS
Michel Bardelmeijer is Tech Lead and Sales at redirect.pizza, where he helps DevOps and IT teams solve domain redirect challenges at scale. Michel has guided organizations like SD Worx, Zurich Airport and Harvard through complex redirect scenarios involving thousands of domains.
Have questions about bulk redirects, HTTPS migrations, or domain consolidations? Connect with Michel on LinkedIn or reach out to the redirect.pizza team.
SSL redirection gets complicated when old domains lose their certificates. You set up a 301 redirect from your old HTTPS domain to a new one, and it works fine for months. Then the SSL certificate on the old domain expires, and every visitor hits a browser security warning instead of being redirected. Bookmarks break, search engine rankings drop, and traffic disappears.
This page explains why HTTPS redirects break, how the SSL/TLS handshake creates this problem, and how to redirect with HTTPS using a DNS-based approach that handles SSL certificates automatically.
Key Takeaways
- When an SSL certificate on a redirected domain expires, browsers block the connection before the redirect can execute. Visitors see an error page instead of reaching your new domain.
- Traditional redirect services only handle HTTP traffic. If someone visits the HTTPS version of your old domain, the redirect breaks.
- redirect.pizza automatically provisions and renews Let's Encrypt certificates for every source domain, so HTTPS redirects keep working without manual certificate management.
- Setting up an HTTPS redirect takes three steps: create an account, add your redirect, and update your DNS records. No hosting or server configuration required.
- If you are migrating domains, always use 301 redirects to permanently transfer your search engine rankings to the new domain.
Quick refresher: redirect types
A redirect sends visitors and search engines from an old URL to a new one. The two types you need to know: 301 redirects for permanently moved pages and 302 redirects for temporary moves. Our 301 vs 302 comparison breaks down when to use each type. For a broader overview of how redirects fit into domain management, see our complete guide to URL redirects.
The benefits of using HTTPS
HTTPS encrypts the connection between a visitor's browser and your website. Most modern websites use it by default, and search engines actively penalize sites that do not. Here is the short version of why it matters:
Search engines want to ensure that their users experience the highest level of security possible. Therefore, websites that use HTTPS are ranked higher by search engines, resulting in improved findability.
Privacy legislation, such as the GDPR, has expedited the rise in SSL encrypted websites. Forms that are completed on your website that contain personal data and website preferences (like filter preferences) are fully shielded.
An HTTPS website uses an encrypted connection. This makes it harder for cyber criminals to hack it and place their own malevolent code.
A padlock symbol in your browser gives the visitor a sense of security and professionalism. Since SSL is becoming more commonplace, the absence of a padlock symbol raises a flag with some security-aware visitors. So, the question is: can you really afford to NOT use SSL?
Why SSL redirects break
HTTPS adds a layer of complexity to redirects that most teams do not anticipate. When you redirect an old domain to a new one, the browser first performs an SSL/TLS handshake with the old domain's server. Only after that handshake succeeds does the server respond with the 301 redirect. If the certificate on the old domain is expired or missing, the browser kills the connection and the redirect never executes.
For a technical breakdown of this process, see Why HTTPS Redirects Break (And How DNS Fixes It).
This is where organizations lose traffic. Search engines still index the HTTPS version of your old domain. Visitors have it bookmarked. Marketing materials and backlinks still point to it. When the SSL certificate expires, all of those links turn into browser error pages instead of redirecting to your new domain. Search engines will eventually drop those URLs from their index, taking your ranking history with them.
"Most teams don't realize the redirect itself requires a valid certificate on the source domain," says Michel Bardelmeijer, Tech Lead at redirect.pizza. "You can have a perfect 301 redirect configured, but if the SSL handshake fails, the browser never even sees it. That is where organizations lose traffic from old domains."
Most traditional redirect services do not issue SSL certificates for the source domain. In the past, a simple DNS "catch all" redirect would work. But now that browsers enforce HTTPS by default, you need a valid SSL certificate on every domain that serves traffic, including domains that only exist to redirect.
Common scenarios where HTTPS redirects fail
Apex to subdomain: Your hosting provider issues the SSL certificate for www.example.com but not for the apex domain (example.com without www). Visitors typing the bare domain hit an SSL error. redirect.pizza handles this automatically and provisions an SSL certificate for the apex domain.
Registrar forwarding limitations: Domain registrars like GoDaddy and Namecheap offer built-in URL forwarding, but their HTTPS support is limited. If you are running into issues with registrar-based forwarding, we have dedicated guides:
Namecheap forwarding with HTTPS
Legacy domain portfolios: After rebrands, acquisitions, or migrations, organizations often have dozens of old domains that still receive traffic. Manually maintaining SSL certificates for each one is expensive and error-prone.
How redirect.pizza solves HTTPS redirection
redirect.pizza is a DNS-based redirect service with built-in Automatic HTTPS. When you add a source domain, redirect.pizza automatically provisions a Let's Encrypt SSL certificate for it. The certificate renews automatically, so your HTTPS redirects keep working indefinitely without manual intervention.
This works differently from server-based solutions like .htaccess or Nginx redirects, which require you to maintain hosting and certificates on the source domain. With redirect.pizza, you point your DNS records to our servers and the redirect is handled at the network level. No web hosting, no server configuration, and no certificate management.
To prevent security issues on your new domain, consider enabling HSTS (HTTP Strict Transport Security), which tells browsers to always connect over HTTPS.
redirect.pizza includes a free tier (Margherita) that covers most use cases. For larger setups, the paid plans support bulk CSV imports, analytics, and API access.
We'll ensure that your SSL certificates are always up to date. This means your website will always be running on HTTPS.
Broken destination monitoring is another feature that comes with redirect.pizza. With this feature, you can always be sure the destination is reachable.
With redirect.pizza, you can use any redirect type you like. We offer advanced redirect options, such as path forwarding and other complex redirect rules. redirect.pizza also supports a wide variety of destination variables.
redirect.pizza includes a useful analytics tool, you can keep track of your redirects' performances. The tool keeps a clear overview of data such as location, device, referrer, and requested pages of your visitors.
Automatic DNS makes it possible to apply automatic DNS in bulk, on multiple hosts or domains in one go. It’s the easiest way to manage all of your redirecting needs from a single platform.
redirect.pizza provides guaranteed responsiveness and the fastest redirects possible. This is made possible with our high-performance edge network. With our global presence, we ensure minimal latency, enhancing overall user experience.
How to implement an SSL/HTTPS redirect using redirect.pizza
Setting up your domain for redirect.pizza is easy. Just follow these three steps and you are good to go:
- 1
Step 1: Create a free account
Getting registered on redirect.pizza is totally free. You can register yourself by signing up with Google, Github, Apple, or create your own account using your email address.
- 2
Step 2: Create redirect
Using our HTTPS redirect service couldn’t be easier. Just fill in the details of your old domain or URL that you want redirected as source URLs. Now add the destination (a new domain or a URL) that you want your source to redirect to. Finally select the type of redirect that you want (301, 302, or another) and click on create. Learn more in our getting started guide.
- 3
Step 3: Adjust DNS settings
The required DNS change pops up. Go to your domain registrar to make this DNS change for the A record. Alternatively, you can use our Automatic DNS feature to make these changes. It may take up to 24 hours for the DNS changes to propagate.
Type in the old URL or domain that you wanted to redirect and confirm that the redirect is working. The SSL certificate for the source domain will be provisioned automatically within minutes.
Related Guides
- Why HTTPS Redirects Break (And How DNS Fixes It)
- What Are 301 Redirects?
- 301 vs 302 Redirects Explained
- URL Redirects: The Complete Guide
Frequently Asked Questions
Yes. When someone visits an HTTPS URL, the browser performs an SSL/TLS handshake before the server can respond with a redirect. If there is no valid certificate, the browser blocks the connection and the redirect never executes. redirect.pizza automatically provisions and renews SSL certificates for every source domain, so you do not need to manage certificates yourself.
Visitors will see a browser security warning or "connection not secure" error instead of being redirected. Search engines will stop following the redirect and may drop the old URL from their index. With redirect.pizza, certificates are renewed automatically through Let's Encrypt, so this does not happen.
Yes. redirect.pizza is a DNS-based redirect service. You point your domain's DNS records to redirect.pizza's servers, and the redirect is handled at the network level. No web hosting, no server configuration, and no .htaccess files required.
Server-based redirects (.htaccess, Nginx, IIS) require you to maintain hosting and SSL certificates on the source domain. redirect.pizza handles both the redirect and the SSL certificate automatically through DNS. This is especially useful for old domains where you no longer want to pay for hosting.
