There is a long, complicated explanation. The short version is, "ignore the message".
For decades, residential class routers came with a web interface that was "http" (no "s"). That is, by definition, "insecure" because the traffic between the user device and the router is not encrypted. People shrugged off the problem because residential routers do not accept connections from the internet, so anyone trying to snoop on the transmission between router and user had to be "inside" the local network.
Some years back, Netgear got SSL certificates for a bunch of domain names, including routerlogin.com, routerlogin.net, orbilogin.com, orbilogin.net. That allowed Netgear to create "https" (secure) web access. Last August, the certificates expired. No one knows if Netgear failed to renew them, or if some (reasonable person) said "How the heck does Netgear get to own an SSL cert for "routerlogin.net"? There are 100's of companies making "routers". Anyway, Netgear flailed around for six months and then stuck a "self-signed" certificate in the lastest Orbi firmware. Sure enough, modern browsers complain about self-signed certs.
It's just a mess. Browsers complain about http because it is "insecure". They complain about the https cert because it is "self-signed."
Just tell the browser, "Yes, already, I know about this site and I want to go to it."
Or, maybe there is something about iPhones that I do not understand.
