18 days ago
I set up the domain I purchased and configured the DNS on Vercel; the check passes and the APIs work correctly. However, when I connect it to my frontend—after adding the backend to the environment variables—it now shows as "Not Secure" instead of the secure status I expected. It has been connected for a few days now, and I was waiting for the SSL (or something similar) to propagate. Could you please help me?
Attachments
3 Replies
18 days ago
This thread has been opened as a bounty so the community can help solve it.
Status changed to Open Railway • 18 days ago
18 days ago
I’d try accessing the URL in an incognito window. I’m able to access the URL just fine without any certificate issues.
18 days ago
Based on the error description and the screenshot showing https://api.versabiz.pe flagged as "No es seguro" (Not Secure), this typically happens due to a few common configuration or SSL certificate provisioning issues:
- Mixed Content Issues (Frontend calling HTTP instead of HTTPS)
Even if your backend domain has a valid SSL certificate, if your frontend is deployed over HTTPS and attempts to fetch or call the backend using http://api.versabiz.pe (hardcoded or misconfigured in environment variables), the browser will block or flag the connection as insecure due to mixed content policies.
Fix: Double-check your frontend environment variables (e.g., NEXT_PUBLIC_API_URL or equivalent) to ensure they explicitly start with https:// rather than http://.
- SSL Certificate Still Provisioning or Domain Validation Pending
Since you configured the custom domain's DNS on Vercel (or whichever host you're using for the API), a "Not Secure" browser warning often means the SSL certificate hasn't finished issuing, or a DNS record (like a missing CNAME or TXT validation record) is misconfigured, preventing Let's Encrypt / the platform from completing the automated HTTPS certificate generation.
Fix: Go back to your hosting dashboard, verify that the custom domain status shows a green/active SSL check, and ensure all DNS records (such as A or CNAME records pointing to your deployment) are fully propagated.
- Missing HSTS or Improper Redirection
If the server accepts plain HTTP traffic without automatically redirecting it to HTTPS, or if the SSL handshake fails on initial load, browsers default to the warning view.
Fix: Ensure your deployment platform or reverse proxy enforces Automatic HTTPS Redirection so any incoming http:// request is seamlessly upgraded to `
18 days ago
Thank you very much for your help. It was actually configured correctly; it was just a matter of waiting. Now it comes up in Safe Mode and I have no issues—everything is working properly. Your comments were very helpful, though! :D
Status changed to Solved mayori • 17 days ago