Investigate the first-connection trust prompt in Geyser NetherNet

Applies to: Geyser; match the linked maintainer documentation to your installed platform and release.
Documentation checked 9 November 2026.

Current Geyser can serve NetherNet signalling over plain HTTP. Bedrock clients may ask whether to trust the endpoint on first use. This prompt concerns signalling transport; it does not show that the Minecraft world or Floodgate account data has changed.

Record the starting point

Record the address players enter, whether it is a domain or an IP, and how signalling reaches Geyser. Check who controls the domain and certificate before planning HTTPS. A hosting-panel allocation alone does not provide a domain certificate or an HTTPS reverse proxy.

Work through the change

Read the HTTPS section linked from the current Geyser setup guide and identify whether the installed release supports your proposed built-in or external signalling arrangement.
Check the certificate name against the exact domain players will use. Keep the existing endpoint available while the certificate and signalling route undergo a separate test.
Have support configure or approve any host-level proxy and certificate path. Do not upload private certificate keys to a public web root or paste them into a ticket.
Test discovery and joining from a fresh client entry. Check both the first connection and a reconnect, and confirm UDP gameplay still reaches the assigned server.

Check the result

With a valid documented HTTPS arrangement, clients should reach signalling under the intended domain without a certificate warning. A successful HTTPS page in a browser does not replace the Bedrock join test, because gameplay uses a different transport path.

If the result differs

A name mismatch, expired certificate or proxy route error needs fixing at that layer. Do not tell clients to ignore TLS errors as a permanent solution. A remaining gameplay timeout may be unrelated to the original trust prompt.

If the HTTPS trial fails, restore the previously recorded signalling route and tell testers which entry to use. Keep ownership of the certificate and domain documented so the same issue does not return at renewal.

Give a LuckPerms permission an expiry without leaving permanent access

Make a LuckPerms event rank expire while preserving other ranks

Limit a LuckPerms command permission to one Minecraft world

Keep a LuckPerms permission local to one network backend

Move a player along a LuckPerms track without replacing unrelated groups

Fix a LuckPerms prefix priority without changing chat formatting

Remove a direct LuckPerms exception without weakening its parent rank

Apply a small LuckPerms web-editor session to the correct server

Export LuckPerms data before changing its storage configuration

Find an inheritance cycle before it complicates a rank change

Keep default-player permissions separate from staff inheritance

Diagnose LuckPerms edits that reach one backend but not another

Check a player UUID before changing LuckPerms account data

Remove a staff member from one LuckPerms track without clearing their account

Give an EssentialsX rank a fixed home limit

Restrict one EssentialsX warp to an approved player group

Test EssentialsX teleport delay and movement cancellation

Add an EssentialsX cooldown to one utility command

Resolve an EssentialsX command alias conflict without removing either plugin

Check EssentialsX AFK kick exemptions for a staff role

Limit EssentialsX nickname changes without granting formatting control

Give staff a read-only EssentialsX player-information role

Recover from an accidental EssentialsX ignore setting

Restrict EssentialsX repair commands to the intended tool policy

Review EssentialsX command-disabled entries after a plugin change

Test an EssentialsX jail location without trapping a real player

Change the EssentialsX starting balance for new players only

Set EssentialsX maximum and minimum money limits with a boundary test

Change the EssentialsX currency symbol without changing stored money

Test an EssentialsX pay dispute using two controlled accounts

Review EssentialsX worth prices before enabling item selling

Explain an EssentialsX balance leaderboard that looks out of date

Trace an unexpected EssentialsX command charge

Back up EssentialsX money before a player-data migration

Verify a LiteBans temporary ban expires at the intended time

Test whether a LiteBans mute covers a private-message command

Build a LiteBans appeal-review role without punishment access

Check a LiteBans moderator’s maximum punishment duration

Find which plugin handled a ban command on a mixed-plugin server

Verify the server scope of a LiteBans network punishment

Investigate a LiteBans database connection failure without losing history

Reverse one appealed LiteBans punishment while preserving the audit trail

Test an AdvancedBan time layout before staff use it

Check AdvancedBan warnings without accidentally escalating a real player

Give an AdvancedBan helper access to history without ban powers

Check AdvancedBan storage before changing from local files to MySQL

Lift one AdvancedBan restriction after an approved appeal

Locate AdvancedBan correctly on a proxy network

Test SuperVanish visibility with separate staff and player accounts

Check whether a vanished SuperVanish moderator can pick up items

Verify flight is safe when a SuperVanish moderator reappears

Check silent chest inspection without changing container contents

Find a SuperVanish join or player-list information leak

Remove vanish access from a staff role without leaving a hidden account

Check PremiumVanish layered visibility after changing staff ranks

Verify PremiumVanish network vanish across Velocity backends

Check vanished staff interactions before a live investigation

Recognize the PremiumVanish API jar before installing an integration

Give GrimAC alerts to one observer without granting exemptions

Remove a GrimAC exemption and verify when checks resume

Collect a GrimAC prediction log for a false-positive report