A visitor usually arrives on http. The certificate is for https. If you do not permanently send the http address to https, the browser shows the warning on the open address.
You turn the redirect on from the panel or from the site’s own setting. Turning both on makes a loop. The certificate is on the certificate card.