SSL modes: Auto, Skip verification, Verify and HTTP only

The four modes

No certificate yet? That’s normal

Many hosts issue a free certificate (for example from Let’s Encrypt) only after the domain points at the new server, because the check is done over HTTP on the domain itself. Until then the server presents a self-signed or default certificate.

Use Skip verification while you test. After the DNS switch, when the certificate is issued, set the link to Verify to confirm it is valid.

Origin without SSL: make the site trust HTTPS

With HTTP only, the visitor talks HTTPS to DNSPeek and DNSPeek talks plain HTTP to your server. Many sites redirect every plain HTTP request to HTTPS; behind DNSPeek that redirect points back at the preview and the browser would loop, so DNSPeek shows “The site requires HTTPS, and HTTPS failed” instead. The fix is to let the site know the visitor is already on HTTPS. With every request DNSPeek sends:

Use the snippet for your server. They only treat a request as HTTPS when X-Forwarded-Proto: https is present, so the site keeps working for normal visitors. The same settings work behind Cloudflare’s Flexible SSL and most load balancers.

Apache (.htaccess). SetEnvIf tells PHP the request is HTTPS. If your .htaccess redirects HTTP to HTTPS, add the X-Forwarded-Proto condition to that rule so it skips requests that are already HTTPS:

# PHP sees $_SERVER['HTTPS'] = 'on' for requests that arrived over HTTPS at a proxy
SetEnvIf X-Forwarded-Proto "^https$" HTTPS=on

# An existing HTTP → HTTPS redirect, made proxy-aware
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteCond %{HTTP:X-Forwarded-Proto} !^https$ [NC]
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

nginx with PHP-FPM. Pass HTTPS=on to PHP when the header says so, and skip the redirect for such requests:

# In the http { } block
map $http_x_forwarded_proto $fastcgi_https {
    default $https;
    https   on;
}

# In the server { } block that listens on port 80
if ($http_x_forwarded_proto != "https") {
    return 301 https://$host$request_uri;
}

# In your location ~ \.php$ { } block, after include fastcgi_params;
fastcgi_param HTTPS $fastcgi_https;

WordPress (wp-config.php). Add this above the line /* That's all, stop editing! */. It stops the “too many redirects” loop and makes WordPress build https:// links:

if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https') {
    $_SERVER['HTTPS'] = 'on';
}

LiteSpeed and OpenLiteSpeed. LiteSpeed reads .htaccess like Apache, so the Apache snippet works. If your LiteSpeed setup ignores SetEnvIf, set the variable with a rewrite rule instead:

RewriteEngine On
RewriteCond %{HTTP:X-Forwarded-Proto} =https
RewriteRule .* - [E=HTTPS:on]

Which mode does my server need?

Right after you create a link, or change its IP or SSL mode, DNSPeek checks the server in the background and shows the result on the link: “Server responds, certificate valid for example.com”, or what is wrong. When a different mode would make the preview load, for example Skip verification for a self-signed or Cloudflare Origin CA certificate, the link offers a one-click switch. With HTTP only, the check warns when the server redirects plain HTTP to HTTPS: add a snippet from Origin without SSL. Re-check runs the check again after you fix the server.

Non-standard ports

DNSPeek uses port 443 for HTTPS and port 80 for HTTP unless you change them under Advanced options when you create the link. Set them if your new server listens elsewhere, for example on a staging port.

Check the certificate yourself

To see exactly which certificate the new server sends for your domain, and when it expires, run:

# Which certificate does the new server present for example.com?
openssl s_client -connect 203.0.113.10:443 -servername example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -subject -issuer -dates

If the subject does not include your domain, the server is not yet configured with the right certificate. A QA report also flags pages that fail to load from the new server.