HTTPS is the ordinary HTTP protocol wrapped in encryption, proven by a certificate a browser can check. The address bar's padlock is that certificate being valid for the exact name you are visiting.
On a custom domain, HTTPS cannot switch on until the domain's DNS record already resolves to the right host: a certificate authority has to confirm the name points where it claims before issuing one. Seeing a warning right after adding a record is expected, not broken.
For the order this actually happens in and how long to wait, see connect a domain you already own.