Some extensions are HTTPS-only. A website on one of these domains will only load in modern browsers once it is served over HTTPS with a valid SSL/TLS certificate. You can register the domain right away, but until HTTPS is configured, visitors will see a security error instead of your site.
Which extensions are affected?
These Google Registry extensions are on the browser HSTS preload list, which tells browsers to only connect over HTTPS:
.app, .boo, .channel, .dad, .day, .dev, .esq, .foo, .ing, .meme, .mov, .new, .nexus, .page, .phd, .prof, .rsvp, .zip
Why HTTPS is required
Being on the HSTS preload list means browsers refuse to load these domains over plain (insecure) HTTP — there is no "click through" warning to bypass. This makes every site in these namespaces secure by default, but it also means a certificate must be in place before the site will work.
How to configure HTTPS
You have a valid certificate in one of three common ways:
- Your hosting provider or website builder — most modern hosts (and site builders, app platforms, and CDNs like Cloudflare) provision and renew SSL certificates for you automatically. If you host your site with one of these, HTTPS is usually enabled with a single setting.
- A free certificate authority — Let's Encrypt issues free, automatically-renewing certificates trusted by all major browsers. Their Getting Started guide covers the common setups.
- A commercial certificate — purchased from a certificate authority or reseller if you need extended validation or a specific warranty.
After installing the certificate, make sure your server serves the site over https:// (and redirects http:// to https://).
Where your domain points
If you park your domain with OrbitFour or use OrbitFour DNS, HTTPS is handled for you on supported pages. Once you point the domain at your own hosting, configuring the certificate is the site owner's responsibility as described above.
Need help?
Contact [email protected] and we'll help you get HTTPS working for your domain.