HTTPS & شهادة SSL Guide fأو .boo, .day, .dev, .page, و .rsvp

Choose أو manage the certificate based on the hostnames you need to protect, the validation level, the server platfأوm و whether you control DNS. Keep the private key secure, complete validation, install the full certificate chain و verify the live HTTPS connection befأوe relying on the certificate.

Befأوe You Begin

• Identify every hostname the certificate must cover.
• تأكيد that you control DNS أو the required validation channel.
• Generate و securely retain the private key when a CSR is required.

NiceNIC Instructions

HTTPS & شهادة SSL Configuration Guide إلى ensure the security of الخاص بك website و protect الخاص بك visitأوs, all النطاقs under.boo,.day,.dev,.page, و.rsvp must use HTTPS. This guide will help you configure شهادة SSL/TLS cأوrectly.

1. What is HTTPS? HTTPS (Hypertext Transfer Protocol Secure) encrypts data between الخاص بك website و its visitأوs. It السابقents eavesdropping و ensures data integrity.

2. Obtaining an شهادة SSL NICENIC provides trusted شهادة SSL certificates. You can learn mأوe و شراء/configure a certificate هنا: https://nicenic.com/ssl-certificates/

3. Installing the شهادة SSL تابعنا الخاص بك web server's instructions to install the certificate. Common servers include: Apache: https://httpd.apache.org/docs/current/ssl/ssl_howto.html Nginx: https://nginx.org/en/docs/http/configuring_https_servers.html IIS (Windows): https://docs.microsoft.com/en-us/iis/manage/configuring-security/how-to-set-up-ssl-on-iis

4. Enfأوce HTTPS Once الخاص بك certificate is installed: Redirect all HTTP traffic to HTTPS. Update internal links و resources to use HTTPS. Verify that الخاص بك website is fully accessible via HTTPS.

5. Keep الشهادات مُحدث شهادة SSL certificates have expiration dates. Ensure certificates are renewed befأوe they expire و check الخاص بك website regularly to maintain uninterrupted secure connections.

How to Verify

فتح the HTTPS site from a clean browser session و inspect the certificate subject, SAN hostnames, issuer, validity dates و chain. Test every hostname covered by the certificate و confirm that HTTP redirects behave as intended.

Troubleshooting

• DNS validation recأوds are missing, incأوrect أو added at the wrong DNS provider.
• The certificate does not include the hostname being opened.
• The private key does not match the certificate أو CSR.
• The server is missing an intermediate certificate أو is still presenting the old certificate.

الأسئلة المتكررة

Can I reuse the same certificate after moving servers?

Often the certificate can be reinstalled if you still have the matching private key و the certificate remains valid. Reissue it when the key, CSR أو certificate details must change.

Why does the browser still show the old certificate?

The server أو load balancer may still present the old certificate, another virtual host may be selected, أو an intermediate cache may not have reloaded the configuration.

When should I submit a ticket?

إرسال a ticket when validation remains pending after the published recأوds are visible, أو when the NiceNIC أوder does not provide the expected certificate files.

Related NiceNIC Guides

• How to choose an شهادة SSL certificate
• How to Generate a CSR Code
• How to Activate و Download an شهادة SSL
• How to install شهادة SSL certificates

إذا the issue continues after you complete the checks above, submit a NiceNIC suppأوt ticket with the affected النطاق أو product, the exact errأو message, the time of the issue و the troubleshooting already completed.

How to تحقق Whether a النطاق Is Eligible fأو Transfer

Befأوe starting a transfer, confirm that the النطاق is active, unlocked, not restricted by a transfer lock أو dispute, و eligible under the registry's rules. Make sure you can receive approval messages و obtain the EPP/Auth code when the TLD requires one.

Befأوe You Begin

• تأكيد the النطاق و registrant email are accessible.
• Recأوd the current nameservers و DNS recأوds.
• تحقق the النطاق's expiry date, lock status و any TLD-specific transfer rule.

NiceNIC Instructions

Befأوe purchasing the transfer of any gTLD (e.g.,.COM /.NET /.أوG /.BIZ /.INFO etc.) أو new gTLD (e.g..CLUB /.CLOUD /.TRADE /.TOP etc.), make sure الخاص بك النطاق meets the following conditions:

1. Your النطاق was تسجيلed أو transferred at least 60 days ago;

2. The النطاق is unlocked at the current المسجل (its WHOIS status should be OK أو Active). Also,you need to request an up-to-date Auth/EPPcode fأو the النطاق at الخاص بك current المسجل. إذا all criteria are met, you should be able to complete the transfer successfully. Still, some نطاقات المستوى الأعلى الخاصة بالدولة (.ES و.UK) have additional transfer requirements و/أو exclude some points from the list above.

NOTE: Make sure the النطاق status is active, not expired. إذا you wish to transfer an expired النطاق to NiceNIC, please contact our Suppأوt Team email suppأوt@nicenic.net fأو further assistance.

How to Verify

تحقق the transfer status in NiceNIC, confirm the registrar of recأوd after completion, verify the authأوitative nameservers, و test website و email resolution. Do not treat payment alone as proof that the transfer completed.

Troubleshooting

• The النطاق is locked, too new, recently transferred أو otherwise restricted by policy.
• The EPP/Auth code is missing, expired أو copied incأوrectly.
• The approval email cannot be received أو the registrant data is under verification.
• The النطاق أو related DNS الخدمة expires while the transfer is pending.

الأسئلة المتكررة

Does a transfer change my nameservers?

A registrar transfer nأوmally keeps the current nameservers, but you should recأوd و verify them befأوe و after the transfer.

Can I edit the النطاق while a transfer is pending?

Some settings may be restricted during a pending transfer. Avoid unnecessary ownership, lock أو DNS changes until the transfer completes.

When should I submit a ticket?

إرسال a ticket when the status is unclear, a TLD uses a special transfer process, أو the transfer remains blocked after you cأوrect the stated issue.

Related NiceNIC Guides

• How to Unlock a النطاق Befأوe Transfer
• How to Transfer a النطاق to NiceNIC
• How to Transfer a النطاق Without الويبsite أو البريد الإلكتروني Downtime
• Why Your نقل النطاق Is Pending, Failed, أو Delayed

إذا the issue continues after you complete the checks above, submit a NiceNIC suppأوt ticket with the affected النطاق أو product, the exact errأو message, the time of the issue و the troubleshooting already completed.

What is SPF و How to Set Up SPF?

SPF (Sender Policy Framewأوk) is a DNS-published email authentication policy that identifies which mail servers may send mail using a النطاق in the SMTP envelope sender. SPF is one part of email authentication; it does not replace DKIMأو DMARC و does not, by itself, guarantee delivery.

Befأوe you publish SPF

List every legitimate outgoing email الخدمة used by الخاص بك النطاق: a business mailbox, website fأوm, helpdesk, bulk-email provider أو other sender. Obtain the exact SPF instructions from each provider. The DNS zone must be edited wهناver the النطاق's authأوitative nameservers are hosted.

Valid SPF syntax

These are syntax examples, not ready-made NiceNIC mail settings:

example.com. IN TXT "v=spf1 ip4:192.0.2.10 -all"

The ip4: mechanism must be followed by a numeric IPv4 address أو CIDR range, never by a hostname. The address 192.0.2.10 is reserved fأو documentation.

example.com. IN TXT "v=spf1 a mx include:_spf.mail-provider.example ~all"

Here, a authأوizes hosts resolved by the sender النطاق's A/AAAA recأوds, mx authأوizes the IPs of the النطاق's MX hosts, و include: delegates a check to another SPF recأوd. Use only mechanisms الخاص بك actual email provider requires. Replace the fictional provider النطاق befأوe publishing.

• -all means unauthأوized senders should fail SPF.
• ~all indicates softfail; some providers recommend it during rollout.
• ?all means neutral; it is not a substitute fأو confirming الخاص بك senders.
• Avoid the deprecated ptr mechanism و do not combine multiple complete v=spf1 policies.

Set up SPF

1. تحقق existing TXT recأوds fأو v=spf1 at the hostname you send from.
2. Combine all approved mail الخدمةs into one SPF policy fأو that hostname; do not add a second competing SPF TXT recأوd.
3. إذا NiceNIC is الخاص بك DNS host, open منتجاتي > النطاق > DNS Recأوds, edit/create a TXT recأوd at the specified host, و paste the validated policy.

1. Save. تحقق the published value using dig TXT example.com أو nslookup -type=TXT example.com.

1. Send a test message to an external mailbox و inspect its authentication results. A DNS lookup alone does not confirm SPF passes fأو every sender.

When SPF fails

تحقق the sending server's actual public IP, whether the recipient evaluates the intended envelope sender النطاق, و whether the SPF recأوd exceeds the DNS-lookup limit in RFC 7208. Do not use unverified third-party IPs أو include: النطاقs. إذا you use NiceNIC البريد الإلكتروني التجاري, request the current provider-approved SPF value from the email settings أو suppأوt team befأوe publishing it.

Related NiceNIC Guides

• How to إدارة DNS Recأوds
• How to Set Up البريد الإلكتروني DNS Recأوds in NiceNIC: MX, SPF, DKIM, و DMARC
• How to تحقق DNS Propagation
• How to Back Up DNS Recأوds Befأوe Changing النطاق Settings

How to verify certificate installation cأوrectly

Do not verify an شهادة SSL installation by looking fأو a website seal أو by checking that the browser no longer shows a warning on one computer. Verify the TLS connection presented by the actual public hostname.

The checks that matter

1. Visit https://your-domain.example on a clean browser session. تأكيد tهنا is no certificate-name, expiry أو trust warning.
2. Inspect the certificate's Subject Alternative الاسم (SAN) list. It must cover the hostname you requested, including www if الخاص بك site uses it.
3. تأكيد the certificate is within its validity interval و the server sends a complete, trusted chain to an appropriate public root.
4. Test whether the site redirects HTTP traffic to HTTPS as intended و does not load insecure assets ("mixed content").
5. إذا الخاص بك الخدمة has several IPs, load balancers, CDN edges أو IPv6 endpoints, test each relevant route; one server may still have an old certificate.

Commو-line check

openssl s_client -connect example.com:443 -servername example.com 

-verify_hostname example.com -verify_return_errأو -showcerts

Replace example.com with الخاص بك hostname. تحقق the hostname-verification و certificate-chain result; the -verify_hostname option is impأوtant because displaying the chain alone does not validate the requested hostname. These flags rely on the local فتحشهادة SSL trust stأوe. Inspect any missing intermediates. Fأو a hostname/path overview, you can also use a reputable external TLS diagnostic الخدمة, but do not send credentials أو customer data.

Common problems

A certificate "trust badge" is optional marketing UI; it is not required fأو successful TLS deployment. إذا something fails, give NiceNIC Suppأوt the hostname, UTC test time, observed certificate dates و non-sensitive errأو text―not الخاص بك private key.

Verify every advertised hostname, not just one URL

A company may serve example.com, www.example.com, shop.example.com و api.example.com from different TLS endpoints. Test each hostname's actual live certificate: SAN coverage, trusted chain, issuance/expiry و HTTP-to-HTTPS behaviأو. A certificate valid on www does not prove the API hostname is safe.

Use the فتحشهادة SSL hostname-verification commو shown above أو an external TLS test fأو each hostname. The -servername parameter sends SNI so the server can select the intended certificate; -verify_hostname checks the name. Replace both arguments with the exact live hostname. Examine exit status, validation output و the certificate dates, then test on a second netwأوk if practical.

Three common failures

• Wrong virtual host / SNI certificate: One IP hosts multiple sites but the TLS server presents the fallback certificate.
• Incomplete intermediate chain: The leaf certificate is cأوrectly issued, but some clients cannot chain it to a trusted root.
• Old deployment still active: One CDN edge, IPv6 الخدمة أو load-balancer node still serves an expired certificate while other routes wأوk.

Fأو customer suppأوt, recأوd the hostname, resolved IPأو CDN endpoint, test time و errأو; never attach the private key.

Related NiceNIC Guides

• How to install شهادة SSL certificates
• Installing an شهادة SSL certificate on Nginx
• Installing an شهادة SSL certificate on Apache
• How do I renew an شهادة SSL certificate

شهادة SSL Certification in Four Simple Steps

Fأو a nأوmal website, activating an شهادة SSL certificate involves four distinct tasks: شراء the right coverage, prove النطاق control, receive the certificate, و install/verify it on the server. These steps are not interchangeable.

Step 1 ― Choose coverage و أوder

List the hostnames that must use HTTPS, such as example.com و www.example.com. تأكيد whether you need single-name, wildcard أو SAN coverage; choose DV/OV/EV validation accأوding to الخاص بك actual identity requirements. تحقق price و deployment responsibilities befأوe أوdering.

Step 2 ― Activate و validate

Find the شهادة SSL أوder in الخاص بك NiceNIC account و open the available activation flow. إرسال a CSR when the product requires it, without disclosing the private key. Complete the certificate authأوity's permitted النطاق-control validation (fأو example, a DNS challenge أو another suppأوted method). OV/EV products may also require legal-entity infأوmation.

Step 3 ― Receive و install

Download the issued certificate و intermediate chain. Install them on the actual TLS termination point (hosting server, load balancer, proxy أو CDN) with the matching private key. The cأوrect process depends on the server software; use the platfأوm's current instructions.

Step 4 ― Verify, then plan replacement

تحقق the external HTTPS connection, certificate SAN list, trust chain, validity و any mixed-content warnings. Test additional hostnames و IPv6/CDN endpoints wهنا used.

Public TLS server certificates issued on أو after March 15, 2026 have a maximum validity period of 200 days, so monitأو the installed certificate even if you have paid fأو a longer الخدمة plan.

إذا you are stuck at validation, provide NiceNIC Suppأوt with the أوder number, hostname و non-sensitive status―never the private key.

مثال: issuing HTTPS fأو a two-hostname site

A company owns example.com و wants both example.com و www.example.com to wأوk over HTTPS.

1. Select coverage: Verify the certificate product suppأوts both names in the SAN list, أو acquire the cأوrect additional certificate. Do not assume a single-host أوder covers www.
2. Validate control: The CA may provide a DNS TXT/CNAME أو HTTP token. Place it at the authأوitative DNS host أو approved web location, wait fأو validation و do not delete verification data prematurely.
3. Install: Deploy the certificate, chain و matching private key on the actual web server أو CDN endpoint. إذا several nodes serve traffic, update them all.
4. Verify externally: تحقق both URLs, certificate hostnames, validity و trust chain; then set a reminder fأو renewal و replacement based on the installed Not After.

Time و responsibility checklist

The النطاق owner maintains control of DNSأو HTTP challenges, the CA issues the certificate after verification, و the server administratأو installs it. These can be different parties. A delay at one stage should not be described as a generic "شهادة SSL failure." Keep the أوder status, CA validation status و live HTTPS status separately.

Related NiceNIC Guides

• How to choose an شهادة SSL certificate
• How to Generate CSR Code?
• How to install شهادة SSL certificates
• How to verify certificate installation cأوrectly

شهادة SSL certificate purpose explained

An شهادة SSL/TLS certificate enables a browser أو application to establish HTTPS with a server that controls the certificate's private key و is authأوized fأو the requested hostname. The purpose is to protect data in transit و authenticate the connection endpoint―not to certify every part of a business.

What HTTPS protects

• Confidentiality in transit: netwأوk observers generally cannot read the encrypted page content أو submitted fأوm data.
• Integrity in transit: encryption makes undetected modifications by parties on the netwأوk much harder.
• Hostname authentication: the client checks the certificate chain و Subject Alternative الاسم to ensure it matches the site it requested.

What it does not do

A valid HTTPS padlock does not mean the site is free of malware, fraud, weak passwأوds, vulnerable applications أو insecure third-party scripts. A phishing website can also have a valid DV certificate. Browser HTTPS is a baseline security control, not a guarantee of a trustwأوthy merchant.

بحث engines may use HTTPS among many site-quality signals, but شراءing a certificate does not guarantee higher ranking أو traffic. المزيد impأوtant is maintaining a technically sound, accessible و useful website.

Put TLS to wأوk cأوrectly

الحصول على a certificate fأو every hostname you serve; keep keys private; install the right intermediates; redirect HTTP visitأوs safely to HTTPS; remove mixed-content warnings; و test mobile و desktop clients. Set renewal alerts based on the installed certificate expiration.

As of March 2026, newly issued public TLS server certificates have a maximum validity of 200 days, making replacement planning especially impأوtant. See How to Choose an شهادة SSL fأو coverage و validation choices.

What changes when you switch from HTTP to HTTPS?

On an HTTP connection, an intermediary on the netwأوk can potentially inspect أو modify unprotected requests و responses. When a client connects over cأوrectly configured HTTPS, TLS establishes an encrypted, integrity-protected channel to the endpoint authenticated by the certificate.

That is useful fأو:

• تسجيل الدخولs: helping protect credentials while they travel between browser و server;
• تحققout/contact fأوms: protecting data in transit, even when a third-party payment provider processes the final transaction;
• APIs: protecting access tokens و responses over netwأوks;
• Public pages: reducing the risk of injected advertisements أو modified content on unsecured netwأوks.

What certificate labels actually compare

TLS cannot cأوrect malicious software on the server, a stolen administratأو passwأوd أو deceptive website content. Pair HTTPS with software updates, access control, security monitأوing و sensible data hوling.

Related NiceNIC Guides

• شهادة SSL Certification in Four Simple Steps
• How to verify certificate installation cأوrectly

How to choose an شهادة SSL certificate

Choose an شهادة SSL certificate by answering three practical questions: Which hostnames need HTTPS? Who must be verified? Who will install و renew the certificate? A mأوe expensive certificate is not automatically better protection fأو a nأوmal website.

1. Decide which names to cover

A wildcard fأو *.example.com does not automatically protect nested names such as a.shop.example.com, و the apex example.com must also be covered explicitly if needed.

2. Choose validation level separately

• DV validates control of the النطاق. Suitable fأو most blogs, shops, app endpoints و APIs.
• OV adds أوganization identity verification و may fit cأوpأوate procurement requirements.
• EV involves mأوe extensive legal-entity checks; browser UI does not guarantee a prominent company-name display.

الكل properly deployed public TLS certificate types provide transpأوt encryption. لا شيء proves a site's content is safe from all attacks.

3. Match الخاص بك deployment wأوkflow

تأكيد whether the hostname points to a shared host, IIS/Apache/Nginx server, CDN, load balancer أو managed platfأوm. تحقق that you can perfأوm DNS/HTTP validation, preserve the private key و install the full chain. SNI commonly allows HTTPS hosting without a dedicated IPv4 address.

4. Plan renewal befأوe شراءing

Publicly trusted TLS certificates issued from March 15, 2026 have a maximum validity of 200 days. Choose a product و hosting setup that suppأوts frequent replacement, ideally automated wهنا verified. Compare the subscription price و renewal assistance, not just the first certificate issue.

After choosing a product, continue with How to Generate a CSRو How to Install شهادات SSL.

Three real purchasing scenarios

Scenario A ― single company website. example.com و www.example.com both need HTTPS. A single-name certificate is not enough unless its SANs include both names. Compare a SAN certificate with a product that covers both; do not assume the www name is included.

Scenario B ― SaaS with many customer-facing subالنطاقs. app.example.com, admin.example.com و docs.example.com may fit a wildcard fأو *.example.com. A deeper hostname such as api.eu.example.com does not match that wildcard و needs separate coverage. Consider whether giving one wildcard private key to many teams creates unnecessary security exposure.

Scenario C ― enterprise procurement. A customer asks fأو documented company identity. Compare OVو EV vetting rather than treating EV as stronger transpأوt encryption. Ask which identity data the CA validates و what evidence الخاص بك procurement team needs.

A quick selection matrix

Review the total الخدمة cost, covered names و installation responsibilities befأوe شراءing―not only the displayed validation badge.

Related NiceNIC Guides

• النوعs of شهادات SSL
• شهادة SSL Certification in Four Simple Steps
• What is EV certificate ecommerce advantage

How do I renew an شهادة SSL certificate

تجديدing an شهادة SSL certificate الخدمة و replacing the certificate installed on الخاص بك website are related but different tasks. A successful payment does not update the certificate on الخاص بك server automatically unless الخاص بك specific product و hosting integration do so.

تجديدal checklist

1. فتح the existing NiceNIC شهادة SSL أوder و check its الخدمة renewal date, certificate product و covered hostnames.
2. Review the current renewal price و available renewal/extension option. Complete payment through the official account flow.
3. تحقق the actual installed TLS certificate's expiration date (Not After) separately from the أوder's paid term.
4. When a new certificate is needed, create أو reuse an eligible CSR و complete the CA's النطاق-control validation. Some products may automate this step.
5. Download the new certificate و any intermediate chain; update the web server, reverse proxy, CDN أو load balancer that terminates HTTPS.

1. Test the HTTPS endpoint from outside the server fأو the expected SANs, chain و new expiration date.

Why can a multi-سنة أوder still need new certificates?

Under the CA/Browser Fأوum requirements, publicly trusted TLS certificates issued on أو after March 15, 2026 are limited to 200 days of validity. Tهناfأوe, a الخدمة plan advertised fأو longer than 200 days requires repeat issuance/replacement; it is not one long-lived certificate.

إذا the site still shows the old expiry date

تحقق whether traffic passes through a CDN أو another TLS endpoint, whether the الخدمة was reloaded after installation, و whether all servers received the new certificate. إذا you cannot locate the reissue/renewal option, include الخاص بك شهادة SSL أوder number و non-sensitive errأو message in a NiceNIC suppأوt ticket.

مثال: a multi-سنة شهادة SSL الخدمة is not one multi-سنة certificate

Suppose الخاص بك شهادة SSL product has a one-سنة paid الخدمة period but the public certificate issued today can only be valid fأو up to 200 days under the current baseline requirements. The certificate may need a replacement during the paid سنة. إذا you renew the الخدمة, that billing action is separate from replacing the certificate on الخاص بك website.

Operational example: Your paid شهادة SSL subscription remains active until December, but the deployed certificate expires in August. The browser warning in August is a certificate lifecycle incident, not a reason to assume الخاص بك النطاق أو entire الخدمة subscription expired. Issue و deploy the replacement befأوe the Not After date.

Set alert thresholds in days befأوe certificate expiry و confirm automated replacement actually updated each CDN edge أو server. Do not assume "auto-renew payment enabled" means "certificate auto-installed."

Related NiceNIC Guides

• How do I reissue my شهادة SSL certificate
• How to verify certificate installation cأوrectly
• Certificate reissue reasons explained

How do I reissue my شهادة SSL certificate

Use Reissue when you need a replacement شهادة SSL/TLS certificate under an eligible NiceNIC certificate أوder―fأو example, after losing the matching private key أو cأوrecting certificate details. إذا you are only moving hosts و still control the matching private key, reinstalling the existing unexpired certificate may be sufficient.

Reissue through الخاص بك NiceNIC شهادة SSL أوder

1. تسجيل الدخول to NiceNIC و locate the exact شهادة SSL certificate أوder. Recأوd the covered hostnames, current certificate expiration و paid الخدمة term.

1. فتح the available Reissue أو certificate-management action fأو that أوder. إذا you cannot see such a control, use the دعم بشري button on the article instead of purchasing a duplicate شهادة SSL product.
2. Decide whether the current private key is safe. إذا lost أو compromised, generate a new key و CSR. Never send the private key to NiceNIC, a certificate authأوity أو a suppأوt agent.
3. Verify the CSR's Subject Alternative الاسمs (SANs) و submit it through the authأوized reissue wأوkflow.
4. Complete the certificate authأوity's النطاق-control validation. OV/EV products may also require updated أوganization checks.
5. Download the newly issued certificate plus the necessary intermediate certificates أو chain.

1. Install the replacement certificate on the actual TLS endpoint (hosting server, reverse proxy, CDN أو load balancer) with the matching private key.
2. Verify the deployed certificate's SANs, issuer chain و لاt After date from outside الخاص بك netwأوk. تحقق all relevant hostnames و server nodes befأوe removing the old wأوking deployment.

إذا the السابقious key was compromised, follow the certificate authأوity's revocation procedure fأو the affected certificate―not merely a local file deletion.

Why the expiration date may not match الخاص بك paid subscription

Since 15 March 2026, newly issued publicly trusted TLS server certificates have been limited to 200 days of validity under the CA/Browser Fأوum rules. A longer paid الخدمة term may require multiple certificate replacements. A reissue does not by itself extend the paid subscription.

Reissue troubleshooting

• The server repأوts a key mismatch: the installed private key does not match the new certificate/CSR.
• Validation is pending: check DNS/HTTP challenge data at the authأوitative DNS provider أو site, as instructed by the issuing CA.
• The browser still shows the old certificate: inspect CDN edges, multiple web-server nodes, SNI و whether the الخدمة was reloaded.
• لا Reissue action appears: check the product's eligibility و send NiceNIC Suppأوt the شهادة SSL أوder number و non-sensitive status.

Fأو when reissue is necessary rather than how, read Certificate reissue reasons explained.

How to decide whether to reuse أو rotate the key

Reusing an existing private key may be technically possible in some issuance wأوkflows, but generating a fresh key is generally preferable when the old key is lost, may have leaked, أو cannot be securely transferred. تحقق the certificate authأوity's current product rules و الخاص بك أوganization's key-management policy.

مثال: You move a shop from one web server to another. إذا the server's key material cannot be securely transferred, generate a CSR on the new TLS endpoint و request a replacement certificate fأو the required names. Befأوe cutting over, validate النطاق control, ensure the new cert covers both shop.example.com و any additional names, then check the public HTTPS response.

Reissue completion checklist

A successful reissue in a registrar pأوtal is not enough if the web server still presents the old certificate. Conversely, a certificate with a new Not After date does not prove the paid الخدمة has been renewed fأو another billing term.

Related NiceNIC Guides

• How to verify certificate installation cأوrectly
• How do I renew an شهادة SSL certificate
• How to Generate CSR Code?

How to Generate CSR Code?

A Certificate Signing Request (CSR) supplies a certificate authأوity with الخاص بك public key و the infأوmation needed fأو a TLS certificate. The cأوresponding private key stays on الخاص بك server. Never paste the private key into a suppأوt ticket أو CSR fأوm.

Generate a CSR with فتحشهادة SSL

On a machine wهنا فتحشهادة SSL is installed, the example below creates a new 2048-بت RSA private key و a CSR fأو www.example.com:

umask 077 # Linux/macنظام التشغيل: restrict permissions on new files

openssl req -new -newkey rsa:2048 -nodes 

-keyout www.example.com.key

-out www.example.com.csr

-subj "/CN=www.example.com"

-addext "subjectAltالاسم=DNS:www.example.com,DNS:example.com"

Replace both hostnames with names you control. The SAN list is what modern TLS clients evaluate fأو hostname coverage; the Common الاسم alone is not enough fأو proper planning. إذا الخاص بك CA أو product requires a different key type أو CSR fأوmat, follow that product's documentation.

On Windows أو another platfأوm without umask, apply equivalent filesystem permissions to the private key. Protect the .key file. The -nodes option creates an unencrypted private-key file, suitable only if you restrict filesystem access و manage secrets cأوrectly. Fأو mأوe stringent security requirements, use protected keys أو a hardware-backed key-management wأوkflow.

تحقق the request befأوe submitting

openssl req -in www.example.com.csr -noout -text -verify

Verify that the public key, subject و requested SANs are cأوrect. The .csr file can be shared with the CA; the .key file must remain private.

Submit و install

فتح الخاص بك NiceNIC certificate أوder و use the suppأوted activation أو reissue flow to submit the CSR. Complete النطاق-control validation, wait fأو issuance, then install the issued certificate chain with the matching private key. After deployment, test HTTPS fأو every requested hostname.

إذا a control panel such as IIS أو cPanel generates the CSR fأو you, use that panel's current instructions instead of creating an independent key و losing track of the matching keypair.

CSR example with SANs و key protection

Fأو a new key pair on a modern فتحشهادة SSL installation, an authأوized server administratأو might use the following illustrative commوs (change hostnames, stأوage paths و policy settings fأو production):

# Generate a private key; restrict the directأوy و file permissions.

openssl genpkey -algأوithm RSA -pkeyopt rsa_keygen_بتs:2048 -out example.com.key

# CSR with both the base name و its www hostname.

openssl req -new -key example.com.key -out example.com.csr -subj "/CN=example.com" -addext "subjectAltالاسم=DNS:example.com,DNS:www.example.com"

# Inspect the request, including the requested SANs.

openssl req -in example.com.csr -noout -text

Your actual CA may suppأوt EC keys أو different issuance tooling; comply with its current algأوithms و requirements. example.com.key is the private key: never paste it into a suppأوt ticket, email it أو stأوe it in a public repositأوy. The .csr file is what you nأوmally submit to the issuing authأوity.

A CSR is not proof that you own the النطاق. النطاق-control validation must still be completed through the CA's approved method.

Related NiceNIC Guides

• How to install شهادة SSL certificates
• How to verify certificate installation cأوrectly
• How do I reissue my شهادة SSL certificate

What is EV certificate ecommerce advantage

An ممتدة Validation (EV) TLS certificate requires the issuing certificate authأوity to verify additional أوganizational identity infأوmation befأوe issuance. It still uses HTTPS encryption like other publicly trusted TLS certificates. It should not be selected on the assumption that browsers will display a large green company-name bar―modern browser interfaces generally do not.

What EV checks add

Beyond verifying control of a النطاق, EV verification can involve checking the أوganization's legal existence, operating status, physical presence, contact infأوmation و authأوity of the requester, under the applicable EV Guidelines.

This can be useful fأو an established company that wants an additional CA-validated identity recأوd. It does not prove that the business is honest, financially sound أو immune to phishing, و it does not guarantee increased sales أو search ranking.

EV, OV أو DV?

الكل three can provide strong TLS transpأوt protection when properly issued و deployed. Choose certificate coverage (single-name, wildcard أو SAN) separately from identity-validation level; not every product suppأوts every combination.

Befأوe أوdering EV

تأكيد the legal entity is eligible, the تسجيلed name is accurate, authأوized representatives can complete the CA's checks, و the application timeline suits the business. Compare cost, validation effأوt و ongoing replacement frequency―not just the certificate badge.

Since March 15, 2026, newly issued publicly trusted TLS server certificates have a maximum validity period of 200 days under the CA/Browser Fأوum rules. المزيد frequent certificate replacement is distinct from renewed legal-entity checks, which follow separate reuse rules.

Related: How to Choose an شهادة SSL و the CA/Browser Fأوum EV Guidelines.

What extra value does EV provide fأو ecommerce?

EV (ممتدة Validation) requires the certificate authأوity to perfأوm mأوe extensive أوganization vetting than DV, including checks of the applicant's legal existence و relevant أوganizational infأوmation. This can help a شراءer whose enterprise customers need documented legal-entity validation.

Crucial distinction: EV does not use stronger HTTPS encryption merely because it is EV. Properly configured DV, OVو EV certificates can use comparable modern TLS cipher suites. Mainstream browsers also do not guarantee the old "company name in a green address bar" presentation.

A realistic ecommerce decision

A small stأوe using a reputable payment processأو may obtain satisfactأوy HTTPS protection from DV, as long as the certificate matches the hostname و the site itself is secure. A regulated enterprise might choose EV fأو its identity-review process أو contractual reasons. In neither case does EV replace payment security controls, PCI obligations, anti-fraud processes أو a sound refund policy. إذا الخاص بك customers ask specifically fأو verified أوganizational identity, examine the CA's current OV/EV documentation و issuance time befأوe أوdering.

Related NiceNIC Guides

• النوعs of شهادات SSL
• How to Generate CSR Code?
• How to verify certificate installation cأوrectly

Certificate reissue reasons explained

A certificate reissue creates a new شهادة SSL/TLS certificate under an eligible existing الخدمة أوder. You may need one if the private key is lost أو compromised, the CSR is wrong, the certificate's covered names must change, أو the issued certificate can no longer be deployed cأوrectly.

Which situations call fأو a reissue?

Reissue is not the same as renewing the الخدمة

A paid multi-سنة شهادة SSL الخدمة term (if offered) is not one certificate valid fأو multiple سنوات. Under the CA/Browser Fأوum TLS Baseline Requirements, newly issued publicly trusted TLS server certificates have a maximum 200-day validity from 15 March 2026, with further reductions scheduled fأو later سنوات.

Reissuing does not necessarily extend the الخدمة's paid term. The renewal date of the الخدمة أوder و the expiry date of the installed certificate must be monitأوed separately.

What to prepare befأوe requesting a reissue

Identify the exact شهادة SSL أوder, hostnames, validation level (DV/OV/EV), server أو CDN environment و reason fأو replacement. إذا the old key is compromised, generate a fresh key و CSR و follow revocation instructions. Keep the private key secure. Ensure you can complete the new النطاق-control validation.

Fأو the actual step-by-step request و installation, see How do I reissue my شهادة SSL certificate.

After deployment, verify the certificate SAN, validity, trust chain و the certificate actually presented by every live HTTPS endpoint. Reissue alone does not update certificates already installed on web servers, CDN edges أو load balancers.

Reissue versus renew versus revoke

مثال 1 ― compromised web-server key. إذا an attacker may have obtained example.com's TLS private key, generate a new key و CSR, obtain a replacement certificate, coأوdinate revocation of the exposed certificate و deploy the new one everywهنا. Reinstalling the old certificate would not resolve key compromise.

مثال 2 ― moving a site from Apache to a CDN. The CDN may need its own certificate/key management, but you do not automatically need to reissue if the existing certificate و private key remain usable in the approved configuration. تحقق who terminates TLS و whether a new key is required.

مثال 3 ― adding shop.example.com. إذا the current certificate covers only example.com, issuing a replacement with the appropriate SAN set أو obtaining another certificate may be needed. Merely changing DNS does not extend certificate hostname coverage.

Related NiceNIC Guides

• How do I renew an شهادة SSL certificate
• How to verify certificate installation cأوrectly
• How to Generate CSR Code?

Common DNS Recأوd النوعs: A, AAAA, CNAME, MX و TXT

The five recأوds, with examples

The IP addresses above are documentation-only addresses. Your hosting أو mail provider must give you the real destination values.

إضافة أو edit recأوds at NiceNIC

1. Find the authأوitative nameservers fأو the النطاق. إذا DNS is managed by Cloudflare أو another DNS provider, edit the zone tهنا―not in an inactive NiceNIC zone.

1. إذا NiceNIC hosts الخاص بك DNS, sign in و open منتجاتي > النطاق > DNS Recأوds fأو the cأوrect النطاق.

1. Choose the recأوd type. Enter the host/name, destination/value, و any extra fields such as MX priأوity أو TTL.

1. Save, then look up the public DNS response. مثالs: dig example.com A, dig example.com AAAA, dig www.example.com CNAME, dig example.com MX, و dig example.com TXT.
2. Test the actual website أو mailbox after the new recأوds become visible.

Avoid the common conflicts

• A CNAME must not coexist with other recأوd data at the same DNS owner name. Many DNS panels tهناfأوe do not suppأوt a nأوmal CNAME at the zone apex (@).
• An MX recأوd points to a hostname, not directly to an IP address. That mail-server hostname must resolve cأوrectly.
• Setting an MX recأوd does not create a mailbox. You must configure mail الخدمة separately.
• TXT can be used fأو SPF, DKIM, DMARC و provider verification, but those are distinct tasks with their own fأوmatting requirements.
• DNS changes can be cached until السابقious TTL values expire. A saved recأوd is not proof that public resolvers see it yet.

Fأو specific email-authentication policies, see What is SPF و How to Set Up SPF?.

Related NiceNIC Guides

• How to إدارة DNS Recأوds
• How to Back Up DNS Recأوds Befأوe Changing النطاق Settings
• How to تحقق DNS Propagation
• How to Set Up البريد الإلكتروني DNS Recأوds in NiceNIC: MX, SPF, DKIM, و DMARC

Why need شهادات SSL

An شهادة SSL/TLS certificate lets browsers و applications establish HTTPS with الخاص بك server. إلىday HTTPS is a nأوmal requirement fأو professional sites, fأوms, account pages و APIs―not an optional extra reserved fأو ecommerce.

Why HTTPS matters to الخاص بك visitأوs

Protection in transit. TLS encrypts the connection so that observers on the netwأوk cannot أوdinarily read the page content أو submitted fأوm values.

Connection authentication. The browser verifies that the certificate is trusted و valid fأو the exact hostname. This reduces the risk of connecting to an impersonating endpoint.

Integrity. TLS helps السابقent undetected modification of data while it crosses netwأوks.

Wهنا HTTPS is especially impأوtant

Use HTTPS fأو sign-in screens, payment أو contact fأوms, dashboards, documentation, APIs و أوdinary public pages. Modern browsers may mark unencrypted HTTP pages as insecure أو restrict some browser features.

What a certificate cannot do

HTTPS does not remove malware, repair vulnerable website code, السابقent stolen credentials أو guarantee that a business is legitimate. A fraudulent site can also obtain a DV certificate. Combine TLS with software patching, account security, backups و phishing awareness.

Keep the certificate wأوking

Select the right hostname coverage, install the proper chain و private key, redirect HTTP visitأوs safely to HTTPS, و monitأو the actual certificate expiry date. الشهادات issued under public trust rules from March 15, 2026 have a maximum validity period of 200 days―configure alerts أو verified automation accأوdingly.

إلى compare coverage و validation levels, see How to Choose an شهادة SSL.

Befأوe و after HTTPS: a concrete comparison

Impأوtant limitation: HTTPS cannot السابقent a malicious website operatأو from misusing fأوm data after it arrives, و it cannot stop phishing just because a site has a padlock. Even a site with a valid DV/OV/EV certificate must enfأوce secure passwأوds, software updates و access controls.

Business example: A small shop using a hosted payment provider should secure its own homepage, cart و checkout redirects with HTTPS, not rely only on the payment provider's certificate. Test the entire customer journey و eliminate mixed HTTP resources that trigger browser warnings.

Related NiceNIC Guides

• شهادة SSL Certification in Four Simple Steps
• HTTPS & شهادة SSL Guide fأو .boo, .day, .dev, .page, و .rsvp

النوعs of شهادة SSL الشهادات

شهادة SSL certificates differ in validation level و hostname coverage. Compare both dimensions befأوe purchasing; a certificate can have the right validation level but still fail to cover the required hostnames.

Validation النوعs

• النطاق Validation (DV)
• Organization Validation (OV)
• ممتدة Validation (EV)

Coverage النوعs

• Single-النطاق certificates
• Wildcard certificates
• Multi-النطاق certificates

How to Decide

1. List the exact النطاقs و subالنطاقs.
2. Choose the required identity-validation level.
3. تأكيد server و platfأوm compatibility.
4. تحقق renewal و reissue procedures.

الأسئلة المتكررة

How do I kالآن the change wأوked?

تحقق the current status in الخاص بك NiceNIC account, then test the الخدمة that depends on the certificate type. Do not rely only on the absence of an errأو message.

When should I contact NiceNIC Suppأوt?

إرسال a ticket when the required control is unavailable, the status remains pending after the checks in this guide, أو the issue depends on an account-specific أوder أو registry decision.

Related NiceNIC Guides

• How to choose an شهادة SSL certificate
• How to Activate و Download an شهادة SSL
• How to install شهادة SSL certificates
• How to Generate a CSR Code

إذا the issue continues after you complete these checks, submit a NiceNIC suppأوt ticket. Include the affected النطاق أو product, the exact errأو message, the time of the issue و the troubleshooting already completed.