SSL for short domains

Why HTTPS is not optional for a redirect

A short link is a request to your short domain that answers with a redirect to the destination. Browsers treat that first request like any other page load. If the domain has no certificate, or the certificate does not match the hostname, the browser interrupts with a full-page warning before the redirect can run. Chrome, Safari and Firefox all do this. Messaging apps and social platforms also fetch the link to build a preview, and many refuse to preview a URL that fails TLS.

There is a quieter reason. Plain HTTP links can be rewritten in transit by networks that inject content. HTTPS prevents that, so the person who clicks lands where you intended.

Who issues the certificate for you

On ReSlug, Short.io, Dub and Cuttly the sequence is automatic. You add the domain, the DNS record propagates, the shortener verifies control of the hostname, and it requests a certificate from a public certificate authority using an automated protocol. The certificate appears within minutes and is renewed before it expires without any action from you. ReSlug's pricing page states that its custom domain includes automatic SSL on every plan, including free.

Bitly, Rebrandly, TinyURL, T.LY, Linkly and Switchy do not describe certificate handling on their pricing pages. That does not mean they lack it; it means you should confirm in the help centre, and test, before relying on it.

What happens without one

If a vendor expects you to supply a certificate, you will need to obtain one for the hostname, upload the certificate and private key in the vendor's settings, and repeat the process before every expiry. Public certificates now last at most a little over a year and the industry is moving toward shorter lifetimes, so manual renewal is a recurring chore with a hard failure mode. A missed renewal breaks every link on the domain at once, on a date you will not be watching.

For a domain that carries printed QR codes, that risk alone justifies choosing a shortener that automates issuance.

How to check a short domain's certificate

1. Open a test link in a private browser window and click the padlock. The certificate should be issued to your short hostname and be within its validity dates.
2. From a terminal, curl -I https://go.example.com/test should return a redirect status such as 301 or 302 with no TLS error.
3. If the domain is behind a CDN proxy, confirm the connection between the proxy and the shortener is also encrypted, not just the browser-to-proxy leg. Some proxy modes accept any certificate from the origin, which hides a misconfiguration.

One DNS record that can block issuance

A CAA record on your domain restricts which certificate authorities may issue for it. If your main domain has a CAA record that lists only your website's authority, the shortener's automated request for the subdomain will be refused and the domain will sit in a pending state. Either add the authority the shortener uses, which its documentation will name, or remove the restriction for the short hostname. The troubleshooting entry walks through the check.