A predictable consequence of a migration if a step is missed.
WHY IT HAPPENS
The certificate lived on the old server. The new server needs its own, and it cannot be issued until the domain resolves there.
THE SEQUENCE
- Point the domain at the new host's nameservers.
- Wait for propagation.
- Run AutoSSL on the new server.
- Enable Force HTTPS Redirect.
- Test.
DURING PROPAGATION
Some visitors reach the old server and some the new. If only one has a valid certificate, some visitors see warnings. This is temporary but looks alarming.
Minimise it by keeping the old hosting live and by lowering DNS TTL before the change.
IF AUTOSSL WILL NOT ISSUE
The domain has not propagated yet, or still points at the old host. Check with a DNS lookup rather than assuming.
AFTER THE CERTIFICATE ISSUES
Check mixed content, since the database may still hold http URLs from the old site. Check mail clients, which may need the mail certificate reissued.
A CHECKLIST ITEM
Add "run AutoSSL" to your post-migration checklist. It is the step most often forgotten.
