HTTPS & SSL Guide fvə ya .boo, .day, .dev, .page, və .rsvp

Choose və ya manage the certificate based on the hostnames you need to protect, the validation level, the server platfvə yam və whether you control DNS. Keep the private key secure, complete validation, install the full certificate chain və verify the live HTTPS connection befvə yae relying on the certificate.

Befvə yae You Begin

• Identify every hostname the certificate must cover.
• Təsdiq et that you control DNS və ya the required validation channel.
• Generate və securely retain the private key when a CSR is required.

NiceNIC Instructions

HTTPS & SSL Configuration Guide Üçün ensure the security of sizin website və protect sizin visitvə yas, all domens under.boo,.day,.dev,.page, və.rsvp must use HTTPS. This guide will help you configure SSL/TLS cvə yarectly.

1. What is HTTPS? HTTPS (Hypertext Transfer Protocol Secure) encrypts data between sizin website və its visitvə yas. It gerients eavesdropping və ensures data integrity.

2. Obtaining an SSL Sertifikatı NICENIC provides trusted SSL certificates. You can learn mvə yae və al/configure a certificate burada: https://nicenic.com/ssl-certificates/

3. Installing the SSL Sertifikatı İzləmək sizin web server's instructions to install the certificate. Common servers include: Apache: https://httpd.apache.org/docs/current/ssl/ssl_howto.html Nginx: https://nginx.org/en/docs/http/configuring_https_servers.html IIS (Windows): https://docs.microsoft.com/en-us/iis/manage/configuring-security/how-to-set-up-ssl-on-iis

4. Enfvə yace HTTPS Once sizin certificate is installed: Redirect all HTTP traffic to HTTPS. Update internal links və resources to use HTTPS. Verify that sizin website is fully accessible via HTTPS.

5. Keep Sertifikatlar Yeniləndi SSL certificates have expiration dates. Ensure certificates are renewed befvə yae they expire və check sizin website regularly to maintain uninterrupted secure connections.

How to Verify

Açıq the HTTPS site from a clean browser session və inspect the certificate subject, SAN hostnames, issuer, validity dates və chain. Test every hostname covered by the certificate və confirm that HTTP redirects behave as intended.

Troubleshooting

• DNS validation recvə yads are missing, incvə yarect və ya added at the wrong DNS provider.
• The certificate does not include the hostname being opened.
• The private key does not match the certificate və ya CSR.
• The server is missing an intermediate certificate və ya is still presenting the old certificate.

Tez-tez verilən suallar

Can I reuse the same certificate after moving servers?

Often the certificate can be reinstalled if you still have the matching private key və the certificate remains valid. Reissue it when the key, CSR və ya certificate details must change.

Why does the browser still show the old certificate?

The server və ya load balancer may still present the old certificate, another virtual host may be selected, və ya an intermediate cache may not have reloaded the configuration.

When should I submit a ticket?

Göndər a ticket when validation remains pending after the published recvə yads are visible, və ya when the NiceNIC və yader does not provide the expected certificate files.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate a CSR Code
• How to Activate və Download an SSL Sertifikatı
• How to install SSL certificates

Əgər the issue continues after you complete the checks above, submit a NiceNIC suppvə yat ticket with the affected domen və ya product, the exact errvə ya message, the time of the issue və the troubleshooting already completed.

How to Yoxla Whether a Domen Is Eligible fvə ya Transfer

Befvə yae starting a transfer, confirm that the domen is active, unlocked, not restricted by a transfer lock və ya dispute, və eligible under the registry's rules. Make sure you can receive approval messages və obtain the EPP/Auth code when the TLD requires one.

Befvə yae You Begin

• Təsdiq et the domen və registrant email are accessible.
• Recvə yad the current nameservers və DNS recvə yads.
• Yoxla the domen's expiry date, lock status və any TLD-specific transfer rule.

NiceNIC Instructions

Befvə yae purchasing the transfer of any gTLD (e.g.,.COM /.NET /.VƏ YAG /.BIZ /.INFO etc.) və ya new gTLD (e.g..CLUB /.CLOUD /.TRADE /.TOP etc.), make sure sizin domen meets the following conditions:

1. Your domen was qeydiyyated və ya transferred at least 60 days ago;

2. The domen is unlocked at the current Qeydiyyatçı (its WHOIS status should be OK və ya Active). Also,you need to request an up-to-date Auth/EPPcode fvə ya the domen at sizin current Qeydiyyatçı. Əgər all criteria are met, you should be able to complete the transfer successfully. Still, some ccTLD-lər (.ES və.UK) have additional transfer requirements və/və ya exclude some points from the list above.

NOTE: Make sure the domen status is active, not expired. Əgər you wish to transfer an expired domen to NiceNIC, please contact our Suppvə yat Team email suppvə yat@nicenic.net fvə ya further assistance.

How to Verify

Yoxla the transfer status in NiceNIC, confirm the registrar of recvə yad after completion, verify the authvə yaitative nameservers, və test website və email resolution. Do not treat payment alone as proof that the transfer completed.

Troubleshooting

• The domen is locked, too new, recently transferred və ya otherwise restricted by policy.
• The EPP/Auth code is missing, expired və ya copied incvə yarectly.
• The approval email cannot be received və ya the registrant data is under verification.
• The domen və ya related DNS Xidmət expires while the transfer is pending.

Tez-tez verilən suallar

Does a transfer change my nameservers?

A registrar transfer nvə yamally keeps the current nameservers, but you should recvə yad və verify them befvə yae və after the transfer.

Can I edit the domen while a transfer is pending?

Some settings may be restricted during a pending transfer. Avoid unnecessary ownership, lock və ya DNS changes until the transfer completes.

When should I submit a ticket?

Göndər a ticket when the status is unclear, a TLD uses a special transfer process, və ya the transfer remains blocked after you cvə yarect the stated issue.

Related NiceNIC Guides

• How to Unlock a Domen Befvə yae Transfer
• How to Transfer a Domen to NiceNIC
• How to Transfer a Domen Without Vebsite və ya Email Downtime
• Why Your Domen Transferi Is Pending, Failed, və ya Delayed

Əgər the issue continues after you complete the checks above, submit a NiceNIC suppvə yat ticket with the affected domen və ya product, the exact errvə ya message, the time of the issue və the troubleshooting already completed.

What is SPF və How to Set Up SPF?

SPF (Sender Policy Framewvə yak) is a DNS-published email authentication policy that identifies which mail servers may send mail using a domen in the SMTP envelope sender. SPF is one part of email authentication; it does not replace DKIMvə ya DMARC və does not, by itself, guarantee delivery.

Befvə yae you publish SPF

List every legitimate outgoing email Xidmət used by sizin domen: a business mailbox, website fvə yam, helpdesk, bulk-email provider və ya other sender. Obtain the exact SPF instructions from each provider. The DNS zone must be edited wburadaver the domen's authvə yaitative nameservers are hosted.

Valid SPF syntax

These are syntax examples, not ready-made NiceNIC mail settings:

example.com. IN TXT "v=spf1 ip4:192.0.2.10 -all"

The ip4: mechanism must be followed by a numeric IPv4 address və ya CIDR range, never by a hostname. The address 192.0.2.10 is reserved fvə ya documentation.

example.com. IN TXT "v=spf1 a mx include:_spf.mail-provider.example ~all"

Here, a authvə yaizes hosts resolved by the sender domen's A/AAAA recvə yads, mx authvə yaizes the IPs of the domen's MX hosts, və include: delegates a check to another SPF recvə yad. Use only mechanisms sizin actual email provider requires. Replace the fictional provider domen befvə yae publishing.

• -all means unauthvə yaized senders should fail SPF.
• ~all indicates softfail; some providers recommend it during rollout.
• ?all means neutral; it is not a substitute fvə ya confirming sizin senders.
• Avoid the deprecated ptr mechanism və do not combine multiple complete v=spf1 policies.

Set up SPF

1. Yoxla existing TXT recvə yads fvə ya v=spf1 at the hostname you send from.
2. Combine all approved mail Xidməts into one SPF policy fvə ya that hostname; do not add a second competing SPF TXT recvə yad.
3. Əgər NiceNIC is sizin DNS host, open Məhsullarım > Domen > DNS Recvə yads, edit/create a TXT recvə yad at the specified host, və paste the validated policy.

1. Save. Yoxla the published value using dig TXT example.com və ya nslookup -type=TXT example.com.

1. Send a test message to an external mailbox və inspect its authentication results. A DNS lookup alone does not confirm SPF passes fvə ya every sender.

When SPF fails

Yoxla the sending server's actual public IP, whether the recipient evaluates the intended envelope sender domen, və whether the SPF recvə yad exceeds the DNS-lookup limit in RFC 7208. Do not use unverified third-party IPs və ya include: domens. Əgər you use NiceNIC Biznes E-poçtu, request the current provider-approved SPF value from the email settings və ya suppvə yat team befvə yae publishing it.

Related NiceNIC Guides

• How to İdarə et DNS Recvə yads
• How to Set Up Email DNS Recvə yads in NiceNIC: MX, SPF, DKIM, və DMARC
• How to Yoxla DNS Propagation
• How to Back Up DNS Recvə yads Befvə yae Changing Domen Settings

How to verify certificate installation cvə yarectly

Do not verify an SSL installation by looking fvə ya a website seal və ya by checking that the browser no longer shows a warning on one computer. Verify the TLS connection presented by the actual public hostname.

The checks that matter

1. Visit https://your-domain.example on a clean browser session. Təsdiq et tburada is no certificate-name, expiry və ya trust warning.
2. Inspect the certificate's Subject Alternative Ad (SAN) list. It must cover the hostname you requested, including www if sizin site uses it.
3. Təsdiq et the certificate is within its validity interval və the server sends a complete, trusted chain to an appropriate public root.
4. Test whether the site redirects HTTP traffic to HTTPS as intended və does not load insecure assets ("mixed content").
5. Əgər sizin Xidmət has several IPs, load balancers, CDN edges və ya IPv6 endpoints, test each relevant route; one server may still have an old certificate.

Commvə-line check

openssl s_client -connect example.com:443 -servername example.com 

-verify_hostname example.com -verify_return_errvə ya -showcerts

Replace example.com with sizin hostname. Yoxla the hostname-verification və certificate-chain result; the -verify_hostname option is impvə yatant because displaying the chain alone does not validate the requested hostname. These flags rely on the local AçıqSSL trust stvə yae. Inspect any missing intermediates. Fvə ya a hostname/path overview, you can also use a reputable external TLS diagnostic Xidmət, but do not send credentials və ya customer data.

Common problems

A certificate "trust badge" is optional marketing UI; it is not required fvə ya successful TLS deployment. Əgər something fails, give NiceNIC Suppvə yat the hostname, UTC test time, observed certificate dates və non-sensitive errvə ya text―not sizin private key.

Verify every advertised hostname, not just one URL

A company may serve example.com, www.example.com, shop.example.com və api.example.com from different TLS endpoints. Test each hostname's actual live certificate: SAN coverage, trusted chain, issuance/expiry və HTTP-to-HTTPS behavivə ya. A certificate valid on www does not prove the API hostname is safe.

Use the AçıqSSL hostname-verification commvə shown above və ya an external TLS test fvə ya each hostname. The -servername parameter sends SNI so the server can select the intended certificate; -verify_hostname checks the name. Replace both arguments with the exact live hostname. Examine exit status, validation output və the certificate dates, then test on a second netwvə yak if practical.

Three common failures

• Wrong virtual host / SNI certificate: One IP hosts multiple sites but the TLS server presents the fallback certificate.
• Incomplete intermediate chain: The leaf certificate is cvə yarectly issued, but some clients cannot chain it to a trusted root.
• Old deployment still active: One CDN edge, IPv6 Xidmət və ya load-balancer node still serves an expired certificate while other routes wvə yak.

Fvə ya customer suppvə yat, recvə yad the hostname, resolved IPvə ya CDN endpoint, test time və errvə ya; never attach the private key.

Related NiceNIC Guides

• How to install SSL certificates
• Installing an SSL certificate on Nginx
• Installing an SSL certificate on Apache
• How do I renew an SSL certificate

SSL Certification in Four Simple Steps

Fvə ya a nvə yamal website, activating an SSL certificate involves four distinct tasks: al the right coverage, prove domen control, receive the certificate, və install/verify it on the server. These steps are not interchangeable.

Step 1 ― Choose coverage və və yader

List the hostnames that must use HTTPS, such as example.com və www.example.com. Təsdiq et whether you need single-name, wildcard və ya SAN coverage; choose DV/OV/EV validation accvə yading to sizin actual identity requirements. Yoxla price və deployment responsibilities befvə yae və yadering.

Step 2 ― Activate və validate

Find the SSL və yader in sizin NiceNIC account və open the available activation flow. Göndər a CSR when the product requires it, without disclosing the private key. Complete the certificate authvə yaity's permitted domen-control validation (fvə ya example, a DNS challenge və ya another suppvə yated method). OV/EV products may also require legal-entity infvə yamation.

Step 3 ― Receive və install

Download the issued certificate və intermediate chain. Install them on the actual TLS termination point (hosting server, load balancer, proxy və ya CDN) with the matching private key. The cvə yarect process depends on the server software; use the platfvə yam's current instructions.

Step 4 ― Verify, then plan replacement

Yoxla the external HTTPS connection, certificate SAN list, trust chain, validity və any mixed-content warnings. Test additional hostnames və IPv6/CDN endpoints wburada used.

Public TLS server certificates issued on və ya after March 15, 2026 have a maximum validity period of 200 days, so monitvə ya the installed certificate even if you have paid fvə ya a longer Xidmət plan.

Əgər you are stuck at validation, provide NiceNIC Suppvə yat with the və yader number, hostname və non-sensitive status―never the private key.

Nümunə: issuing HTTPS fvə ya a two-hostname site

A company owns example.com və wants both example.com və www.example.com to wvə yak over HTTPS.

1. Select coverage: Verify the certificate product suppvə yats both names in the SAN list, və ya acquire the cvə yarect additional certificate. Do not assume a single-host və yader covers www.
2. Validate control: The CA may provide a DNS TXT/CNAME və ya HTTP token. Place it at the authvə yaitative DNS host və ya approved web location, wait fvə ya validation və do not delete verification data prematurely.
3. Install: Deploy the certificate, chain və matching private key on the actual web server və ya CDN endpoint. Əgər several nodes serve traffic, update them all.
4. Verify externally: Yoxla both URLs, certificate hostnames, validity və trust chain; then set a reminder fvə ya renewal və replacement based on the installed Not After.

Time və responsibility checklist

The domen owner maintains control of DNSvə ya HTTP challenges, the CA issues the certificate after verification, və the server administratvə ya installs it. These can be different parties. A delay at one stage should not be described as a generic "SSL failure." Keep the və yader status, CA validation status və live HTTPS status separately.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate CSR Code?
• How to install SSL certificates
• How to verify certificate installation cvə yarectly

SSL certificate purpose explained

An SSL/TLS certificate enables a browser və ya application to establish HTTPS with a server that controls the certificate's private key və is authvə yaized fvə ya the requested hostname. The purpose is to protect data in transit və authenticate the connection endpoint―not to certify every part of a business.

What HTTPS protects

• Confidentiality in transit: netwvə yak observers generally cannot read the encrypted page content və ya submitted fvə yam data.
• Integrity in transit: encryption makes undetected modifications by parties on the netwvə yak much harder.
• Hostname authentication: the client checks the certificate chain və Subject Alternative Ad to ensure it matches the site it requested.

What it does not do

A valid HTTPS padlock does not mean the site is free of malware, fraud, weak passwvə yads, vulnerable applications və ya insecure third-party scripts. A phishing website can also have a valid DV certificate. Browser HTTPS is a baseline security control, not a guarantee of a trustwvə yathy merchant.

Axtarış engines may use HTTPS among many site-quality signals, but almaqing a certificate does not guarantee higher ranking və ya traffic. Daha çox impvə yatant is maintaining a technically sound, accessible və useful website.

Put TLS to wvə yak cvə yarectly

Əldə et a certificate fvə ya every hostname you serve; keep keys private; install the right intermediates; redirect HTTP visitvə yas safely to HTTPS; remove mixed-content warnings; və test mobile və desktop clients. Set renewal alerts based on the installed certificate expiration.

As of March 2026, newly issued public TLS server certificates have a maximum validity of 200 days, making replacement planning especially impvə yatant. See How to Choose an SSL Sertifikatı fvə ya coverage və validation choices.

What changes when you switch from HTTP to HTTPS?

On an HTTP connection, an intermediary on the netwvə yak can potentially inspect və ya modify unprotected requests və responses. When a client connects over cvə yarectly configured HTTPS, TLS establishes an encrypted, integrity-protected channel to the endpoint authenticated by the certificate.

That is useful fvə ya:

• Daxil ols: helping protect credentials while they travel between browser və server;
• Yoxlaout/contact fvə yams: protecting data in transit, even when a third-party payment provider processes the final transaction;
• APIs: protecting access tokens və responses over netwvə yaks;
• Public pages: reducing the risk of injected advertisements və ya modified content on unsecured netwvə yaks.

What certificate labels actually compare

TLS cannot cvə yarect malicious software on the server, a stolen administratvə ya passwvə yad və ya deceptive website content. Pair HTTPS with software updates, access control, security monitvə yaing və sensible data hvəling.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• How to verify certificate installation cvə yarectly

How to choose an SSL certificate

Choose an SSL certificate by answering three practical questions: Which hostnames need HTTPS? Who must be verified? Who will install və renew the certificate? A mvə yae expensive certificate is not automatically better protection fvə ya a nvə yamal website.

1. Decide which names to cover

A wildcard fvə ya *.example.com does not automatically protect nested names such as a.shop.example.com, və the apex example.com must also be covered explicitly if needed.

2. Choose validation level separately

• DV validates control of the domen. Suitable fvə ya most blogs, shops, app endpoints və APIs.
• OV adds və yaganization identity verification və may fit cvə yapvə yaate procurement requirements.
• EV involves mvə yae extensive legal-entity checks; browser UI does not guarantee a prominent company-name display.

Hamısı properly deployed public TLS certificate types provide transpvə yat encryption. Heç biri proves a site's content is safe from all attacks.

3. Match sizin deployment wvə yakflow

Təsdiq et whether the hostname points to a shared host, IIS/Apache/Nginx server, CDN, load balancer və ya managed platfvə yam. Yoxla that you can perfvə yam DNS/HTTP validation, preserve the private key və install the full chain. SNI commonly allows HTTPS hosting without a dedicated IPv4 address.

4. Plan renewal befvə yae almaqing

Publicly trusted TLS certificates issued from March 15, 2026 have a maximum validity of 200 days. Choose a product və hosting setup that suppvə yats frequent replacement, ideally automated wburada verified. Compare the subscription price və renewal assistance, not just the first certificate issue.

After choosing a product, continue with How to Generate a CSRvə How to Install SSL Sertifikatları.

Three real purchasing scenarios

Scenario A ― single company website. example.com və www.example.com both need HTTPS. A single-name certificate is not enough unless its SANs include both names. Compare a SAN certificate with a product that covers both; do not assume the www name is included.

Scenario B ― SaaS with many customer-facing subdomens. app.example.com, admin.example.com və docs.example.com may fit a wildcard fvə ya *.example.com. A deeper hostname such as api.eu.example.com does not match that wildcard və needs separate coverage. Consider whether giving one wildcard private key to many teams creates unnecessary security exposure.

Scenario C ― enterprise procurement. A customer asks fvə ya documented company identity. Compare OVvə EV vetting rather than treating EV as stronger transpvə yat encryption. Ask which identity data the CA validates və what evidence sizin procurement team needs.

A quick selection matrix

Review the total Xidmət cost, covered names və installation responsibilities befvə yae almaqing―not only the displayed validation badge.

Related NiceNIC Guides

• Növs of SSL Sertifikatları
• SSL Certification in Four Simple Steps
• What is EV certificate ecommerce advantage

How do I renew an SSL certificate

Yeniləing an SSL certificate Xidmət və replacing the certificate installed on sizin website are related but different tasks. A successful payment does not update the certificate on sizin server automatically unless sizin specific product və hosting integration do so.

Yeniləal checklist

1. Açıq the existing NiceNIC SSL və yader və check its Xidmət renewal date, certificate product və covered hostnames.
2. Review the current renewal price və available renewal/extension option. Complete payment through the official account flow.
3. Yoxla the actual installed TLS certificate's expiration date (Not After) separately from the və yader's paid term.
4. When a new certificate is needed, create və ya reuse an eligible CSR və complete the CA's domen-control validation. Some products may automate this step.
5. Download the new certificate və any intermediate chain; update the web server, reverse proxy, CDN və ya load balancer that terminates HTTPS.

1. Test the HTTPS endpoint from outside the server fvə ya the expected SANs, chain və new expiration date.

Why can a multi-il və yader still need new certificates?

Under the CA/Browser Fvə yaum requirements, publicly trusted TLS certificates issued on və ya after March 15, 2026 are limited to 200 days of validity. Tburadafvə yae, a Xidmət plan advertised fvə ya longer than 200 days requires repeat issuance/replacement; it is not one long-lived certificate.

Əgər the site still shows the old expiry date

Yoxla whether traffic passes through a CDN və ya another TLS endpoint, whether the Xidmət was reloaded after installation, və whether all servers received the new certificate. Əgər you cannot locate the reissue/renewal option, include sizin SSL və yader number və non-sensitive errvə ya message in a NiceNIC suppvə yat ticket.

Nümunə: a multi-il SSL Xidmət is not one multi-il certificate

Suppose sizin SSL product has a one-il paid Xidmət period but the public certificate issued today can only be valid fvə ya up to 200 days under the current baseline requirements. The certificate may need a replacement during the paid il. Əgər you renew the Xidmət, that billing action is separate from replacing the certificate on sizin website.

Operational example: Your paid SSL subscription remains active until December, but the deployed certificate expires in August. The browser warning in August is a certificate lifecycle incident, not a reason to assume sizin domen və ya entire Xidmət subscription expired. Issue və deploy the replacement befvə yae the Not After date.

Set alert thresholds in days befvə yae certificate expiry və confirm automated replacement actually updated each CDN edge və ya server. Do not assume "auto-renew payment enabled" means "certificate auto-installed."

Related NiceNIC Guides

• How do I reissue my SSL certificate
• How to verify certificate installation cvə yarectly
• Certificate reissue reasons explained

How do I reissue my SSL certificate

Use Reissue when you need a replacement SSL/TLS certificate under an eligible NiceNIC certificate və yader―fvə ya example, after losing the matching private key və ya cvə yarecting certificate details. Əgər you are only moving hosts və still control the matching private key, reinstalling the existing unexpired certificate may be sufficient.

Reissue through sizin NiceNIC SSL və yader

1. Daxil ol to NiceNIC və locate the exact SSL certificate və yader. Recvə yad the covered hostnames, current certificate expiration və paid Xidmət term.

1. Açıq the available Reissue və ya certificate-management action fvə ya that və yader. Əgər you cannot see such a control, use the İnsan Dəstəyi button on the article instead of purchasing a duplicate SSL product.
2. Decide whether the current private key is safe. Əgər lost və ya compromised, generate a new key və CSR. Never send the private key to NiceNIC, a certificate authvə yaity və ya a suppvə yat agent.
3. Verify the CSR's Subject Alternative Ads (SANs) və submit it through the authvə yaized reissue wvə yakflow.
4. Complete the certificate authvə yaity's domen-control validation. OV/EV products may also require updated və yaganization checks.
5. Download the newly issued certificate plus the necessary intermediate certificates və ya chain.

1. Install the replacement certificate on the actual TLS endpoint (hosting server, reverse proxy, CDN və ya load balancer) with the matching private key.
2. Verify the deployed certificate's SANs, issuer chain və Xeyrt After date from outside sizin netwvə yak. Yoxla all relevant hostnames və server nodes befvə yae removing the old wvə yaking deployment.

Əgər the geriious key was compromised, follow the certificate authvə yaity's revocation procedure fvə ya the affected certificate―not merely a local file deletion.

Why the expiration date may not match sizin paid subscription

Since 15 March 2026, newly issued publicly trusted TLS server certificates have been limited to 200 days of validity under the CA/Browser Fvə yaum rules. A longer paid Xidmət term may require multiple certificate replacements. A reissue does not by itself extend the paid subscription.

Reissue troubleshooting

• The server repvə yats a key mismatch: the installed private key does not match the new certificate/CSR.
• Validation is pending: check DNS/HTTP challenge data at the authvə yaitative DNS provider və ya site, as instructed by the issuing CA.
• The browser still shows the old certificate: inspect CDN edges, multiple web-server nodes, SNI və whether the Xidmət was reloaded.
• Xeyr Reissue action appears: check the product's eligibility və send NiceNIC Suppvə yat the SSL və yader number və non-sensitive status.

Fvə ya when reissue is necessary rather than how, read Certificate reissue reasons explained.

How to decide whether to reuse və ya rotate the key

Reusing an existing private key may be technically possible in some issuance wvə yakflows, but generating a fresh key is generally preferable when the old key is lost, may have leaked, və ya cannot be securely transferred. Yoxla the certificate authvə yaity's current product rules və sizin və yaganization's key-management policy.

Nümunə: You move a shop from one web server to another. Əgər the server's key material cannot be securely transferred, generate a CSR on the new TLS endpoint və request a replacement certificate fvə ya the required names. Befvə yae cutting over, validate domen control, ensure the new cert covers both shop.example.com və any additional names, then check the public HTTPS response.

Reissue completion checklist

A successful reissue in a registrar pvə yatal is not enough if the web server still presents the old certificate. Conversely, a certificate with a new Not After date does not prove the paid Xidmət has been renewed fvə ya another billing term.

Related NiceNIC Guides

• How to verify certificate installation cvə yarectly
• How do I renew an SSL certificate
• How to Generate CSR Code?

How to Generate CSR Code?

A Certificate Signing Request (CSR) supplies a certificate authvə yaity with sizin public key və the infvə yamation needed fvə ya a TLS certificate. The cvə yaresponding private key stays on sizin server. Never paste the private key into a suppvə yat ticket və ya CSR fvə yam.

Generate a CSR with AçıqSSL

On a machine wburada AçıqSSL is installed, the example below creates a new 2048-bit RSA private key və a CSR fvə ya www.example.com:

umask 077 # Linux/macƏS: restrict permissions on new files

openssl req -new -newkey rsa:2048 -nodes 

-keyout www.example.com.key

-out www.example.com.csr

-subj "/CN=www.example.com"

-addext "subjectAltAd=DNS:www.example.com,DNS:example.com"

Replace both hostnames with names you control. The SAN list is what modern TLS clients evaluate fvə ya hostname coverage; the Common Ad alone is not enough fvə ya proper planning. Əgər sizin CA və ya product requires a different key type və ya CSR fvə yamat, follow that product's documentation.

On Windows və ya another platfvə yam without umask, apply equivalent filesystem permissions to the private key. Protect the .key file. The -nodes option creates an unencrypted private-key file, suitable only if you restrict filesystem access və manage secrets cvə yarectly. Fvə ya mvə yae stringent security requirements, use protected keys və ya a hardware-backed key-management wvə yakflow.

Yoxla the request befvə yae submitting

openssl req -in www.example.com.csr -noout -text -verify

Verify that the public key, subject və requested SANs are cvə yarect. The .csr file can be shared with the CA; the .key file must remain private.

Submit və install

Açıq sizin NiceNIC certificate və yader və use the suppvə yated activation və ya reissue flow to submit the CSR. Complete domen-control validation, wait fvə ya issuance, then install the issued certificate chain with the matching private key. After deployment, test HTTPS fvə ya every requested hostname.

Əgər a control panel such as IIS və ya cPanel generates the CSR fvə ya you, use that panel's current instructions instead of creating an independent key və losing track of the matching keypair.

CSR example with SANs və key protection

Fvə ya a new key pair on a modern AçıqSSL installation, an authvə yaized server administratvə ya might use the following illustrative commvəs (change hostnames, stvə yaage paths və policy settings fvə ya production):

# Generate a private key; restrict the directvə yay və file permissions.

openssl genpkey -algvə yaithm RSA -pkeyopt rsa_keygen_bits:2048 -out example.com.key

# CSR with both the base name və its www hostname.

openssl req -new -key example.com.key -out example.com.csr -subj "/CN=example.com" -addext "subjectAltAd=DNS:example.com,DNS:www.example.com"

# Inspect the request, including the requested SANs.

openssl req -in example.com.csr -noout -text

Your actual CA may suppvə yat EC keys və ya different issuance tooling; comply with its current algvə yaithms və requirements. example.com.key is the private key: never paste it into a suppvə yat ticket, email it və ya stvə yae it in a public repositvə yay. The .csr file is what you nvə yamally submit to the issuing authvə yaity.

A CSR is not proof that you own the domen. Domen-control validation must still be completed through the CA's approved method.

Related NiceNIC Guides

• How to install SSL certificates
• How to verify certificate installation cvə yarectly
• How do I reissue my SSL certificate

What is EV certificate ecommerce advantage

An Genişləndirilmiş Validation (EV) TLS certificate requires the issuing certificate authvə yaity to verify additional və yaganizational identity infvə yamation befvə yae issuance. It still uses HTTPS encryption like other publicly trusted TLS certificates. It should not be selected on the assumption that browsers will display a large green company-name bar―modern browser interfaces generally do not.

What EV checks add

Beyond verifying control of a domen, EV verification can involve checking the və yaganization's legal existence, operating status, physical presence, contact infvə yamation və authvə yaity of the requester, under the applicable EV Guidelines.

This can be useful fvə ya an established company that wants an additional CA-validated identity recvə yad. It does not prove that the business is honest, financially sound və ya immune to phishing, və it does not guarantee increased sales və ya search ranking.

EV, OV və ya DV?

Hamısı three can provide strong TLS transpvə yat protection when properly issued və deployed. Choose certificate coverage (single-name, wildcard və ya SAN) separately from identity-validation level; not every product suppvə yats every combination.

Befvə yae və yadering EV

Təsdiq et the legal entity is eligible, the qeydiyyated name is accurate, authvə yaized representatives can complete the CA's checks, və the application timeline suits the business. Compare cost, validation effvə yat və ongoing replacement frequency―not just the certificate badge.

Since March 15, 2026, newly issued publicly trusted TLS server certificates have a maximum validity period of 200 days under the CA/Browser Fvə yaum rules. Daha çox frequent certificate replacement is distinct from renewed legal-entity checks, which follow separate reuse rules.

Related: How to Choose an SSL Sertifikatı və the CA/Browser Fvə yaum EV Guidelines.

What extra value does EV provide fvə ya ecommerce?

EV (Genişləndirilmiş Validation) requires the certificate authvə yaity to perfvə yam mvə yae extensive və yaganization vetting than DV, including checks of the applicant's legal existence və relevant və yaganizational infvə yamation. This can help a almaqer whose enterprise customers need documented legal-entity validation.

Crucial distinction: EV does not use stronger HTTPS encryption merely because it is EV. Properly configured DV, OVvə EV certificates can use comparable modern TLS cipher suites. Mainstream browsers also do not guarantee the old "company name in a green address bar" presentation.

A realistic ecommerce decision

A small stvə yae using a reputable payment processvə ya may obtain satisfactvə yay HTTPS protection from DV, as long as the certificate matches the hostname və the site itself is secure. A regulated enterprise might choose EV fvə ya its identity-review process və ya contractual reasons. In neither case does EV replace payment security controls, PCI obligations, anti-fraud processes və ya a sound refund policy. Əgər sizin customers ask specifically fvə ya verified və yaganizational identity, examine the CA's current OV/EV documentation və issuance time befvə yae və yadering.

Related NiceNIC Guides

• Növs of SSL Sertifikatları
• How to Generate CSR Code?
• How to verify certificate installation cvə yarectly

Certificate reissue reasons explained

A certificate reissue creates a new SSL/TLS certificate under an eligible existing Xidmət və yader. You may need one if the private key is lost və ya compromised, the CSR is wrong, the certificate's covered names must change, və ya the issued certificate can no longer be deployed cvə yarectly.

Which situations call fvə ya a reissue?

Reissue is not the same as renewing the Xidmət

A paid multi-il SSL Xidmət term (if offered) is not one certificate valid fvə ya multiple il. Under the CA/Browser Fvə yaum TLS Baseline Requirements, newly issued publicly trusted TLS server certificates have a maximum 200-day validity from 15 March 2026, with further reductions scheduled fvə ya later il.

Reissuing does not necessarily extend the Xidmət's paid term. The renewal date of the Xidmət və yader və the expiry date of the installed certificate must be monitvə yaed separately.

What to prepare befvə yae requesting a reissue

Identify the exact SSL və yader, hostnames, validation level (DV/OV/EV), server və ya CDN environment və reason fvə ya replacement. Əgər the old key is compromised, generate a fresh key və CSR və follow revocation instructions. Keep the private key secure. Ensure you can complete the new domen-control validation.

Fvə ya the actual step-by-step request və installation, see How do I reissue my SSL certificate.

After deployment, verify the certificate SAN, validity, trust chain və the certificate actually presented by every live HTTPS endpoint. Reissue alone does not update certificates already installed on web servers, CDN edges və ya load balancers.

Reissue versus renew versus revoke

Nümunə 1 ― compromised web-server key. Əgər an attacker may have obtained example.com's TLS private key, generate a new key və CSR, obtain a replacement certificate, covə yadinate revocation of the exposed certificate və deploy the new one everywburada. Reinstalling the old certificate would not resolve key compromise.

Nümunə 2 ― moving a site from Apache to a CDN. The CDN may need its own certificate/key management, but you do not automatically need to reissue if the existing certificate və private key remain usable in the approved configuration. Yoxla who terminates TLS və whether a new key is required.

Nümunə 3 ― adding shop.example.com. Əgər the current certificate covers only example.com, issuing a replacement with the appropriate SAN set və ya obtaining another certificate may be needed. Merely changing DNS does not extend certificate hostname coverage.

Related NiceNIC Guides

• How do I renew an SSL certificate
• How to verify certificate installation cvə yarectly
• How to Generate CSR Code?

Common DNS Recvə yad Növs: A, AAAA, CNAME, MX və TXT

The five recvə yads, with examples

The IP addresses above are documentation-only addresses. Your hosting və ya mail provider must give you the real destination values.

Əlavə et və ya edit recvə yads at NiceNIC

1. Find the authvə yaitative nameservers fvə ya the domen. Əgər DNS is managed by Cloudflare və ya another DNS provider, edit the zone tburada―not in an inactive NiceNIC zone.

1. Əgər NiceNIC hosts sizin DNS, sign in və open Məhsullarım > Domen > DNS Recvə yads fvə ya the cvə yarect domen.

1. Choose the recvə yad type. Enter the host/name, destination/value, və any extra fields such as MX privə yaity və ya TTL.

1. Save, then look up the public DNS response. Nümunəs: dig example.com A, dig example.com AAAA, dig www.example.com CNAME, dig example.com MX, və dig example.com TXT.
2. Test the actual website və ya mailbox after the new recvə yads become visible.

Avoid the common conflicts

• A CNAME must not coexist with other recvə yad data at the same DNS owner name. Many DNS panels tburadafvə yae do not suppvə yat a nvə yamal CNAME at the zone apex (@).
• An MX recvə yad points to a hostname, not directly to an IP address. That mail-server hostname must resolve cvə yarectly.
• Setting an MX recvə yad does not create a mailbox. You must configure mail Xidmət separately.
• TXT can be used fvə ya SPF, DKIM, DMARC və provider verification, but those are distinct tasks with their own fvə yamatting requirements.
• DNS changes can be cached until geriious TTL values expire. A saved recvə yad is not proof that public resolvers see it yet.

Fvə ya specific email-authentication policies, see What is SPF və How to Set Up SPF?.

Related NiceNIC Guides

• How to İdarə et DNS Recvə yads
• How to Back Up DNS Recvə yads Befvə yae Changing Domen Settings
• How to Yoxla DNS Propagation
• How to Set Up Email DNS Recvə yads in NiceNIC: MX, SPF, DKIM, və DMARC

Why need SSL Sertifikatları

An SSL/TLS certificate lets browsers və applications establish HTTPS with sizin server. Üçünday HTTPS is a nvə yamal requirement fvə ya professional sites, fvə yams, account pages və APIs―not an optional extra reserved fvə ya ecommerce.

Why HTTPS matters to sizin visitvə yas

Protection in transit. TLS encrypts the connection so that observers on the netwvə yak cannot və yadinarily read the page content və ya submitted fvə yam values.

Connection authentication. The browser verifies that the certificate is trusted və valid fvə ya the exact hostname. This reduces the risk of connecting to an impersonating endpoint.

Integrity. TLS helps gerient undetected modification of data while it crosses netwvə yaks.

Wburada HTTPS is especially impvə yatant

Use HTTPS fvə ya sign-in screens, payment və ya contact fvə yams, dashboards, documentation, APIs və və yadinary public pages. Modern browsers may mark unencrypted HTTP pages as insecure və ya restrict some browser features.

What a certificate cannot do

HTTPS does not remove malware, repair vulnerable website code, gerient stolen credentials və ya guarantee that a business is legitimate. A fraudulent site can also obtain a DV certificate. Combine TLS with software patching, account security, backups və phishing awareness.

Keep the certificate wvə yaking

Select the right hostname coverage, install the proper chain və private key, redirect HTTP visitvə yas safely to HTTPS, və monitvə ya the actual certificate expiry date. Sertifikatlar issued under public trust rules from March 15, 2026 have a maximum validity period of 200 days―configure alerts və ya verified automation accvə yadingly.

Üçün compare coverage və validation levels, see How to Choose an SSL Sertifikatı.

Befvə yae və after HTTPS: a concrete comparison

Impvə yatant limitation: HTTPS cannot gerient a malicious website operatvə ya from misusing fvə yam data after it arrives, və it cannot stop phishing just because a site has a padlock. Even a site with a valid DV/OV/EV certificate must enfvə yace secure passwvə yads, software updates və access controls.

Business example: A small shop using a hosted payment provider should secure its own homepage, cart və checkout redirects with HTTPS, not rely only on the payment provider's certificate. Test the entire customer journey və eliminate mixed HTTP resources that trigger browser warnings.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• HTTPS & SSL Guide fvə ya .boo, .day, .dev, .page, və .rsvp

Növs of SSL Sertifikatlar

SSL certificates differ in validation level və hostname coverage. Compare both dimensions befvə yae purchasing; a certificate can have the right validation level but still fail to cover the required hostnames.

Validation Növs

• Domen Validation (DV)
• Organization Validation (OV)
• Genişləndirilmiş Validation (EV)

Coverage Növs

• Single-domen certificates
• Wildcard certificates
• Multi-domen certificates

How to Decide

1. List the exact domens və subdomens.
2. Choose the required identity-validation level.
3. Təsdiq et server və platfvə yam compatibility.
4. Yoxla renewal və reissue procedures.

Tez-tez verilən suallar

How do I kindi the change wvə yaked?

Yoxla the current status in sizin NiceNIC account, then test the Xidmət that depends on the certificate type. Do not rely only on the absence of an errvə ya message.

When should I contact NiceNIC Suppvə yat?

Göndər a ticket when the required control is unavailable, the status remains pending after the checks in this guide, və ya the issue depends on an account-specific və yader və ya registry decision.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Activate və Download an SSL Sertifikatı
• How to install SSL certificates
• How to Generate a CSR Code

Əgər the issue continues after you complete these checks, submit a NiceNIC suppvə yat ticket. Include the affected domen və ya product, the exact errvə ya message, the time of the issue və the troubleshooting already completed.