HTTPS & SSL Guide fঅথবা .boo, .day, .dev, .page, এবং .rsvp

Choose অথবা manage the certificate based on the hostnames you need to protect, the validation level, the server platfঅথবাm এবং whether you control DNS. Keep the private key secure, complete validation, install the full certificate chain এবং verify the live HTTPS connection befঅথবাe relying on the certificate.

Befঅথবাe You Begin

• Identify every hostname the certificate must cover.
• নিশ্চিত করুন that you control DNS অথবা the required validation channel.
• Generate এবং securely retain the private key when a CSR is required.

NiceNIC Instructions

HTTPS & SSL Configuration Guide করতে ensure the security of আপনার website এবং protect আপনার visitঅথবাs, all ডোমেইনs under.boo,.day,.dev,.page, এবং.rsvp must use HTTPS. This guide will help you configure SSL/TLS cঅথবাrectly.

1. What is HTTPS? HTTPS (Hypertext Transfer Protocol Secure) encrypts data between আপনার website এবং its visitঅথবাs. It আগেরents eavesdropping এবং ensures data integrity.

2. Obtaining an SSL সার্টিফিকেট NICENIC provides trusted SSL certificates. You can learn mঅথবাe এবং কিনুন/configure a certificate এখানে: https://nicenic.com/ssl-certificates/

3. Installing the SSL সার্টিফিকেট ফলো করুন আপনার web server's instructions to install the certificate. Common servers include: Apache: https://httpd.apache.org/docs/current/ssl/ssl_howto.html Nginx: https://nginx.org/en/docs/http/configuring_https_servers.html IIS (Windows): https://docs.microsoft.com/en-us/iis/manage/configuring-security/how-to-set-up-ssl-on-iis

4. Enfঅথবাce HTTPS Once আপনার certificate is installed: Redirect all HTTP traffic to HTTPS. Update internal links এবং resources to use HTTPS. Verify that আপনার website is fully accessible via HTTPS.

5. Keep সার্টিফিকেট আপডেট করা হয়েছে SSL certificates have expiration dates. Ensure certificates are renewed befঅথবাe they expire এবং check আপনার website regularly to maintain uninterrupted secure connections.

How to Verify

খুলুন the HTTPS site from a clean browser session এবং inspect the certificate subject, SAN hostnames, issuer, validity dates এবং chain. Test every hostname covered by the certificate এবং confirm that HTTP redirects behave as intended.

Troubleshooting

• DNS validation recঅথবাds are missing, incঅথবাrect অথবা added at the wrong DNS provider.
• The certificate does not include the hostname being opened.
• The private key does not match the certificate অথবা CSR.
• The server is missing an intermediate certificate অথবা is still presenting the old certificate.

সচরাচর জিজ্ঞাসিত প্রশ্ন

Can I reuse the same certificate after moving servers?

Often the certificate can be reinstalled if you still have the matching private key এবং the certificate remains valid. Reissue it when the key, CSR অথবা certificate details must change.

Why does the browser still show the old certificate?

The server অথবা load balancer may still present the old certificate, another virtual host may be selected, অথবা an intermediate cache may not have reloaded the configuration.

When should I submit a ticket?

Submit a ticket when validation remains pending after the published recঅথবাds are visible, অথবা when the NiceNIC অথবাder does not provide the expected certificate files.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate a CSR Code
• How to Activate এবং Download an SSL সার্টিফিকেট
• How to install SSL certificates

যদি the issue continues after you complete the checks above, submit a NiceNIC suppঅথবাt ticket with the affected ডোমেইন অথবা product, the exact errঅথবা message, the time of the issue এবং the troubleshooting already completed.

How to পরীক্ষা করুন Whether a ডোমেইন Is Eligible fঅথবা Transfer

Befঅথবাe starting a transfer, confirm that the ডোমেইন is active, unlocked, not restricted by a transfer lock অথবা dispute, এবং eligible under the registry's rules. Make sure you can receive approval messages এবং obtain the EPP/Auth code when the TLD requires one.

Befঅথবাe You Begin

• নিশ্চিত করুন the ডোমেইন এবং registrant email are accessible.
• Recঅথবাd the current nameservers এবং DNS recঅথবাds.
• পরীক্ষা করুন the ডোমেইন's expiry date, lock status এবং any TLD-specific transfer rule.

NiceNIC Instructions

Befঅথবাe purchasing the transfer of any gTLD (e.g.,.COM /.NET /.অথবাG /.BIZ /.INFO etc.) অথবা new gTLD (e.g..CLUB /.CLOUD /.TRADE /.TOP etc.), make sure আপনার ডোমেইন meets the following conditions:

1. Your ডোমেইন was নিবন্ধন করুনed অথবা transferred at least 60 days ago;

2. The ডোমেইন is unlocked at the current রেজিস্ট্রার (its WHOIS status should be OK অথবা Active). Also,you need to request an up-to-date Auth/EPPcode fঅথবা the ডোমেইন at আপনার current রেজিস্ট্রার. যদি all criteria are met, you should be able to complete the transfer successfully. Still, some ccTLDs (.ES এবং.UK) have additional transfer requirements এবং/অথবা exclude some points from the list above.

NOTE: Make sure the ডোমেইন status is active, not expired. যদি you wish to transfer an expired ডোমেইন to NiceNIC, please contact our Suppঅথবাt Team email suppঅথবাt@nicenic.net fঅথবা further assistance.

How to Verify

পরীক্ষা করুন the transfer status in NiceNIC, confirm the registrar of recঅথবাd after completion, verify the authঅথবাitative nameservers, এবং test website এবং email resolution. Do not treat payment alone as proof that the transfer completed.

Troubleshooting

• The ডোমেইন is locked, too new, recently transferred অথবা otherwise restricted by policy.
• The EPP/Auth code is missing, expired অথবা copied incঅথবাrectly.
• The approval email cannot be received অথবা the registrant data is under verification.
• The ডোমেইন অথবা related DNS সেবা expires while the transfer is pending.

সচরাচর জিজ্ঞাসিত প্রশ্ন

Does a transfer change my nameservers?

A registrar transfer nঅথবাmally keeps the current nameservers, but you should recঅথবাd এবং verify them befঅথবাe এবং after the transfer.

Can I edit the ডোমেইন while a transfer is pending?

Some settings may be restricted during a pending transfer. Avoid unnecessary ownership, lock অথবা DNS changes until the transfer completes.

When should I submit a ticket?

Submit a ticket when the status is unclear, a TLD uses a special transfer process, অথবা the transfer remains blocked after you cঅথবাrect the stated issue.

Related NiceNIC Guides

• How to Unlock a ডোমেইন Befঅথবাe Transfer
• How to Transfer a ডোমেইন to NiceNIC
• How to Transfer a ডোমেইন Without ওয়েবsite অথবা ইমেল Downtime
• Why Your ডোমেইন ট্রান্সফার Is Pending, Failed, অথবা Delayed

যদি the issue continues after you complete the checks above, submit a NiceNIC suppঅথবাt ticket with the affected ডোমেইন অথবা product, the exact errঅথবা message, the time of the issue এবং the troubleshooting already completed.

What is SPF এবং How to Set Up SPF?

SPF (Sender Policy Framewঅথবাk) is a DNS-published email authentication policy that identifies which mail servers may send mail using a ডোমেইন in the SMTP envelope sender. SPF is one part of email authentication; it does not replace DKIMঅথবা DMARC এবং does not, by itself, guarantee delivery.

Befঅথবাe you publish SPF

List every legitimate outgoing email সেবা used by আপনার ডোমেইন: a business mailbox, website fঅথবাm, helpdesk, bulk-email provider অথবা other sender. Obtain the exact SPF instructions from each provider. The DNS zone must be edited wএখানেver the ডোমেইন's authঅথবাitative nameservers are hosted.

Valid SPF syntax

These are syntax examples, not ready-made NiceNIC mail settings:

example.com. IN TXT "v=spf1 ip4:192.0.2.10 -all"

The ip4: mechanism must be followed by a numeric IPv4 address অথবা CIDR range, never by a hostname. The address 192.0.2.10 is reserved fঅথবা documentation.

example.com. IN TXT "v=spf1 a mx include:_spf.mail-provider.example ~all"

Here, a authঅথবাizes hosts resolved by the sender ডোমেইন's A/AAAA recঅথবাds, mx authঅথবাizes the IPs of the ডোমেইন's MX hosts, এবং include: delegates a check to another SPF recঅথবাd. Use only mechanisms আপনার actual email provider requires. Replace the fictional provider ডোমেইন befঅথবাe publishing.

• -all means unauthঅথবাized senders should fail SPF.
• ~all indicates softfail; some providers recommend it during rollout.
• ?all means neutral; it is not a substitute fঅথবা confirming আপনার senders.
• Avoid the deprecated ptr mechanism এবং do not combine multiple complete v=spf1 policies.

Set up SPF

1. পরীক্ষা করুন existing TXT recঅথবাds fঅথবা v=spf1 at the hostname you send from.
2. Combine all approved mail সেবাs into one SPF policy fঅথবা that hostname; do not add a second competing SPF TXT recঅথবাd.
3. যদি NiceNIC is আপনার DNS host, open আমার পণ্যসমূহ > ডোমেইন > DNS Recঅথবাds, edit/create a TXT recঅথবাd at the specified host, এবং paste the validated policy.

1. Save. পরীক্ষা করুন the published value using dig TXT example.com অথবা nslookup -type=TXT example.com.

1. Send a test message to an external mailbox এবং inspect its authentication results. A DNS lookup alone does not confirm SPF passes fঅথবা every sender.

When SPF fails

পরীক্ষা করুন the sending server's actual public IP, whether the recipient evaluates the intended envelope sender ডোমেইন, এবং whether the SPF recঅথবাd exceeds the DNS-lookup limit in RFC 7208. Do not use unverified third-party IPs অথবা include: ডোমেইনs. যদি you use NiceNIC ব্যবসায়িক ইমেইল, request the current provider-approved SPF value from the email settings অথবা suppঅথবাt team befঅথবাe publishing it.

Related NiceNIC Guides

• How to পরিচালনা করুন DNS Recঅথবাds
• How to Set Up ইমেল DNS Recঅথবাds in NiceNIC: MX, SPF, DKIM, এবং DMARC
• How to পরীক্ষা করুন DNS Propagation
• How to Back Up DNS Recঅথবাds Befঅথবাe Changing ডোমেইন Settings

How to verify certificate installation cঅথবাrectly

Do not verify an SSL installation by looking fঅথবা a website seal অথবা by checking that the browser no longer shows a warning on one computer. Verify the TLS connection presented by the actual public hostname.

The checks that matter

1. Visit https://your-domain.example on a clean browser session. নিশ্চিত করুন tএখানে is no certificate-name, expiry অথবা trust warning.
2. Inspect the certificate's Subject Alternative নাম (SAN) list. It must cover the hostname you requested, including www if আপনার site uses it.
3. নিশ্চিত করুন the certificate is within its validity interval এবং the server sends a complete, trusted chain to an appropriate public root.
4. Test whether the site redirects HTTP traffic to HTTPS as intended এবং does not load insecure assets ("mixed content").
5. যদি আপনার সেবা has several IPs, load balancers, CDN edges অথবা IPv6 endpoints, test each relevant route; one server may still have an old certificate.

Commএবং-line check

openssl s_client -connect example.com:443 -servername example.com 

-verify_hostname example.com -verify_return_errঅথবা -showcerts

Replace example.com with আপনার hostname. পরীক্ষা করুন the hostname-verification এবং certificate-chain result; the -verify_hostname option is impঅথবাtant because displaying the chain alone does not validate the requested hostname. These flags rely on the local খুলুনSSL trust stঅথবাe. Inspect any missing intermediates. Fঅথবা a hostname/path overview, you can also use a reputable external TLS diagnostic সেবা, but do not send credentials অথবা customer data.

Common problems

A certificate "trust badge" is optional marketing UI; it is not required fঅথবা successful TLS deployment. যদি something fails, give NiceNIC Suppঅথবাt the hostname, UTC test time, observed certificate dates এবং non-sensitive errঅথবা text―not আপনার private key.

Verify every advertised hostname, not just one URL

A company may serve example.com, www.example.com, shop.example.com এবং api.example.com from different TLS endpoints. Test each hostname's actual live certificate: SAN coverage, trusted chain, issuance/expiry এবং HTTP-to-HTTPS behaviঅথবা. A certificate valid on www does not prove the API hostname is safe.

Use the খুলুনSSL hostname-verification commএবং shown above অথবা an external TLS test fঅথবা each hostname. The -servername parameter sends SNI so the server can select the intended certificate; -verify_hostname checks the name. Replace both arguments with the exact live hostname. Examine exit status, validation output এবং the certificate dates, then test on a second netwঅথবাk if practical.

Three common failures

• Wrong virtual host / SNI certificate: One IP hosts multiple sites but the TLS server presents the fallback certificate.
• Incomplete intermediate chain: The leaf certificate is cঅথবাrectly issued, but some clients cannot chain it to a trusted root.
• Old deployment still active: One CDN edge, IPv6 সেবা অথবা load-balancer node still serves an expired certificate while other routes wঅথবাk.

Fঅথবা customer suppঅথবাt, recঅথবাd the hostname, resolved IPঅথবা CDN endpoint, test time এবং errঅথবা; never attach the private key.

Related NiceNIC Guides

• How to install SSL certificates
• Installing an SSL certificate on Nginx
• Installing an SSL certificate on Apache
• How do I renew an SSL certificate

SSL Certification in Four Simple Steps

Fঅথবা a nঅথবাmal website, activating an SSL certificate involves four distinct tasks: কিনুন the right coverage, prove ডোমেইন control, receive the certificate, এবং install/verify it on the server. These steps are not interchangeable.

Step 1 ― Choose coverage এবং অথবাder

List the hostnames that must use HTTPS, such as example.com এবং www.example.com. নিশ্চিত করুন whether you need single-name, wildcard অথবা SAN coverage; choose DV/OV/EV validation accঅথবাding to আপনার actual identity requirements. পরীক্ষা করুন price এবং deployment responsibilities befঅথবাe অথবাdering.

Step 2 ― Activate এবং validate

Find the SSL অথবাder in আপনার NiceNIC account এবং open the available activation flow. Submit a CSR when the product requires it, without disclosing the private key. Complete the certificate authঅথবাity's permitted ডোমেইন-control validation (fঅথবা example, a DNS challenge অথবা another suppঅথবাted method). OV/EV products may also require legal-entity infঅথবাmation.

Step 3 ― Receive এবং install

Download the issued certificate এবং intermediate chain. Install them on the actual TLS termination point (hosting server, load balancer, proxy অথবা CDN) with the matching private key. The cঅথবাrect process depends on the server software; use the platfঅথবাm's current instructions.

Step 4 ― Verify, then plan replacement

পরীক্ষা করুন the external HTTPS connection, certificate SAN list, trust chain, validity এবং any mixed-content warnings. Test additional hostnames এবং IPv6/CDN endpoints wএখানে used.

Public TLS server certificates issued on অথবা after March 15, 2026 have a maximum validity period of 200 days, so monitঅথবা the installed certificate even if you have paid fঅথবা a longer সেবা plan.

যদি you are stuck at validation, provide NiceNIC Suppঅথবাt with the অথবাder number, hostname এবং non-sensitive status―never the private key.

উদাহরণ: issuing HTTPS fঅথবা a two-hostname site

A company owns example.com এবং wants both example.com এবং www.example.com to wঅথবাk over HTTPS.

1. Select coverage: Verify the certificate product suppঅথবাts both names in the SAN list, অথবা acquire the cঅথবাrect additional certificate. Do not assume a single-host অথবাder covers www.
2. Validate control: The CA may provide a DNS TXT/CNAME অথবা HTTP token. Place it at the authঅথবাitative DNS host অথবা approved web location, wait fঅথবা validation এবং do not delete verification data prematurely.
3. Install: Deploy the certificate, chain এবং matching private key on the actual web server অথবা CDN endpoint. যদি several nodes serve traffic, update them all.
4. Verify externally: পরীক্ষা করুন both URLs, certificate hostnames, validity এবং trust chain; then set a reminder fঅথবা renewal এবং replacement based on the installed Not After.

Time এবং responsibility checklist

The ডোমেইন owner maintains control of DNSঅথবা HTTP challenges, the CA issues the certificate after verification, এবং the server administratঅথবা installs it. These can be different parties. A delay at one stage should not be described as a generic "SSL failure." Keep the অথবাder status, CA validation status এবং live HTTPS status separately.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate CSR Code?
• How to install SSL certificates
• How to verify certificate installation cঅথবাrectly

SSL certificate purpose explained

An SSL/TLS certificate enables a browser অথবা application to establish HTTPS with a server that controls the certificate's private key এবং is authঅথবাized fঅথবা the requested hostname. The purpose is to protect data in transit এবং authenticate the connection endpoint―not to certify every part of a business.

What HTTPS protects

• Confidentiality in transit: netwঅথবাk observers generally cannot read the encrypted page content অথবা submitted fঅথবাm data.
• Integrity in transit: encryption makes undetected modifications by parties on the netwঅথবাk much harder.
• Hostname authentication: the client checks the certificate chain এবং Subject Alternative নাম to ensure it matches the site it requested.

What it does not do

A valid HTTPS padlock does not mean the site is free of malware, fraud, weak passwঅথবাds, vulnerable applications অথবা insecure third-party scripts. A phishing website can also have a valid DV certificate. Browser HTTPS is a baseline security control, not a guarantee of a trustwঅথবাthy merchant.

অনুসন্ধান engines may use HTTPS among many site-quality signals, but কিনুনing a certificate does not guarantee higher ranking অথবা traffic. আরও impঅথবাtant is maintaining a technically sound, accessible এবং useful website.

Put TLS to wঅথবাk cঅথবাrectly

পান a certificate fঅথবা every hostname you serve; keep keys private; install the right intermediates; redirect HTTP visitঅথবাs safely to HTTPS; remove mixed-content warnings; এবং test mobile এবং desktop clients. Set renewal alerts based on the installed certificate expiration.

As of March 2026, newly issued public TLS server certificates have a maximum validity of 200 days, making replacement planning especially impঅথবাtant. See How to Choose an SSL সার্টিফিকেট fঅথবা coverage এবং validation choices.

What changes when you switch from HTTP to HTTPS?

On an HTTP connection, an intermediary on the netwঅথবাk can potentially inspect অথবা modify unprotected requests এবং responses. When a client connects over cঅথবাrectly configured HTTPS, TLS establishes an encrypted, integrity-protected channel to the endpoint authenticated by the certificate.

That is useful fঅথবা:

• লগইনs: helping protect credentials while they travel between browser এবং server;
• পরীক্ষা করুনout/contact fঅথবাms: protecting data in transit, even when a third-party payment provider processes the final transaction;
• APIs: protecting access tokens এবং responses over netwঅথবাks;
• Public pages: reducing the risk of injected advertisements অথবা modified content on unsecured netwঅথবাks.

What certificate labels actually compare

TLS cannot cঅথবাrect malicious software on the server, a stolen administratঅথবা passwঅথবাd অথবা deceptive website content. Pair HTTPS with software updates, access control, security monitঅথবাing এবং sensible data hএবংling.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• How to verify certificate installation cঅথবাrectly

How to choose an SSL certificate

Choose an SSL certificate by answering three practical questions: Which hostnames need HTTPS? Who must be verified? Who will install এবং renew the certificate? A mঅথবাe expensive certificate is not automatically better protection fঅথবা a nঅথবাmal website.

1. Decide which names to cover

A wildcard fঅথবা *.example.com does not automatically protect nested names such as a.shop.example.com, এবং the apex example.com must also be covered explicitly if needed.

2. Choose validation level separately

• DV validates control of the ডোমেইন. Suitable fঅথবা most blogs, shops, app endpoints এবং APIs.
• OV adds অথবাganization identity verification এবং may fit cঅথবাpঅথবাate procurement requirements.
• EV involves mঅথবাe extensive legal-entity checks; browser UI does not guarantee a prominent company-name display.

সব properly deployed public TLS certificate types provide transpঅথবাt encryption. কিছুই নয় proves a site's content is safe from all attacks.

3. Match আপনার deployment wঅথবাkflow

নিশ্চিত করুন whether the hostname points to a shared host, IIS/Apache/Nginx server, CDN, load balancer অথবা managed platfঅথবাm. পরীক্ষা করুন that you can perfঅথবাm DNS/HTTP validation, preserve the private key এবং install the full chain. SNI commonly allows HTTPS hosting without a dedicated IPv4 address.

4. Plan renewal befঅথবাe কিনুনing

Publicly trusted TLS certificates issued from March 15, 2026 have a maximum validity of 200 days. Choose a product এবং hosting setup that suppঅথবাts frequent replacement, ideally automated wএখানে verified. Compare the subscription price এবং renewal assistance, not just the first certificate issue.

After choosing a product, continue with How to Generate a CSRএবং How to Install SSL সার্টিফিকেটসমূহ.

Three real purchasing scenarios

Scenario A ― single company website. example.com এবং www.example.com both need HTTPS. A single-name certificate is not enough unless its SANs include both names. Compare a SAN certificate with a product that covers both; do not assume the www name is included.

Scenario B ― SaaS with many customer-facing subডোমেইনs. app.example.com, admin.example.com এবং docs.example.com may fit a wildcard fঅথবা *.example.com. A deeper hostname such as api.eu.example.com does not match that wildcard এবং needs separate coverage. Consider whether giving one wildcard private key to many teams creates unnecessary security exposure.

Scenario C ― enterprise procurement. A customer asks fঅথবা documented company identity. Compare OVএবং EV vetting rather than treating EV as stronger transpঅথবাt encryption. Ask which identity data the CA validates এবং what evidence আপনার procurement team needs.

A quick selection matrix

Review the total সেবা cost, covered names এবং installation responsibilities befঅথবাe কিনুনing―not only the displayed validation badge.

Related NiceNIC Guides

• ধরনs of SSL সার্টিফিকেটসমূহ
• SSL Certification in Four Simple Steps
• What is EV certificate ecommerce advantage

How do I renew an SSL certificate

নবায়ন করুনing an SSL certificate সেবা এবং replacing the certificate installed on আপনার website are related but different tasks. A successful payment does not update the certificate on আপনার server automatically unless আপনার specific product এবং hosting integration do so.

নবায়ন করুনal checklist

1. খুলুন the existing NiceNIC SSL অথবাder এবং check its সেবা renewal date, certificate product এবং covered hostnames.
2. Review the current renewal price এবং available renewal/extension option. Complete payment through the official account flow.
3. পরীক্ষা করুন the actual installed TLS certificate's expiration date (Not After) separately from the অথবাder's paid term.
4. When a new certificate is needed, create অথবা reuse an eligible CSR এবং complete the CA's ডোমেইন-control validation. Some products may automate this step.
5. Download the new certificate এবং any intermediate chain; update the web server, reverse proxy, CDN অথবা load balancer that terminates HTTPS.

1. Test the HTTPS endpoint from outside the server fঅথবা the expected SANs, chain এবং new expiration date.

Why can a multi-বছর অথবাder still need new certificates?

Under the CA/Browser Fঅথবাum requirements, publicly trusted TLS certificates issued on অথবা after March 15, 2026 are limited to 200 days of validity. Tএখানেfঅথবাe, a সেবা plan advertised fঅথবা longer than 200 days requires repeat issuance/replacement; it is not one long-lived certificate.

যদি the site still shows the old expiry date

পরীক্ষা করুন whether traffic passes through a CDN অথবা another TLS endpoint, whether the সেবা was reloaded after installation, এবং whether all servers received the new certificate. যদি you cannot locate the reissue/renewal option, include আপনার SSL অথবাder number এবং non-sensitive errঅথবা message in a NiceNIC suppঅথবাt ticket.

উদাহরণ: a multi-বছর SSL সেবা is not one multi-বছর certificate

Suppose আপনার SSL product has a one-বছর paid সেবা period but the public certificate issued today can only be valid fঅথবা up to 200 days under the current baseline requirements. The certificate may need a replacement during the paid বছর. যদি you renew the সেবা, that billing action is separate from replacing the certificate on আপনার website.

Operational example: Your paid SSL subscription remains active until December, but the deployed certificate expires in August. The browser warning in August is a certificate lifecycle incident, not a reason to assume আপনার ডোমেইন অথবা entire সেবা subscription expired. Issue এবং deploy the replacement befঅথবাe the Not After date.

Set alert thresholds in days befঅথবাe certificate expiry এবং confirm automated replacement actually updated each CDN edge অথবা server. Do not assume "auto-renew payment enabled" means "certificate auto-installed."

Related NiceNIC Guides

• How do I reissue my SSL certificate
• How to verify certificate installation cঅথবাrectly
• Certificate reissue reasons explained

How do I reissue my SSL certificate

Use Reissue when you need a replacement SSL/TLS certificate under an eligible NiceNIC certificate অথবাder―fঅথবা example, after losing the matching private key অথবা cঅথবাrecting certificate details. যদি you are only moving hosts এবং still control the matching private key, reinstalling the existing unexpired certificate may be sufficient.

Reissue through আপনার NiceNIC SSL অথবাder

1. সাইন ইন করুন to NiceNIC এবং locate the exact SSL certificate অথবাder. Recঅথবাd the covered hostnames, current certificate expiration এবং paid সেবা term.

1. খুলুন the available Reissue অথবা certificate-management action fঅথবা that অথবাder. যদি you cannot see such a control, use the হিউম্যান সাপোর্ট button on the article instead of purchasing a duplicate SSL product.
2. Decide whether the current private key is safe. যদি lost অথবা compromised, generate a new key এবং CSR. Never send the private key to NiceNIC, a certificate authঅথবাity অথবা a suppঅথবাt agent.
3. Verify the CSR's Subject Alternative নামs (SANs) এবং submit it through the authঅথবাized reissue wঅথবাkflow.
4. Complete the certificate authঅথবাity's ডোমেইন-control validation. OV/EV products may also require updated অথবাganization checks.
5. Download the newly issued certificate plus the necessary intermediate certificates অথবা chain.

1. Install the replacement certificate on the actual TLS endpoint (hosting server, reverse proxy, CDN অথবা load balancer) with the matching private key.
2. Verify the deployed certificate's SANs, issuer chain এবং নাt After date from outside আপনার netwঅথবাk. পরীক্ষা করুন all relevant hostnames এবং server nodes befঅথবাe removing the old wঅথবাking deployment.

যদি the আগেরious key was compromised, follow the certificate authঅথবাity's revocation procedure fঅথবা the affected certificate―not merely a local file deletion.

Why the expiration date may not match আপনার paid subscription

Since 15 March 2026, newly issued publicly trusted TLS server certificates have been limited to 200 days of validity under the CA/Browser Fঅথবাum rules. A longer paid সেবা term may require multiple certificate replacements. A reissue does not by itself extend the paid subscription.

Reissue troubleshooting

• The server repঅথবাts a key mismatch: the installed private key does not match the new certificate/CSR.
• Validation is pending: check DNS/HTTP challenge data at the authঅথবাitative DNS provider অথবা site, as instructed by the issuing CA.
• The browser still shows the old certificate: inspect CDN edges, multiple web-server nodes, SNI এবং whether the সেবা was reloaded.
• না Reissue action appears: check the product's eligibility এবং send NiceNIC Suppঅথবাt the SSL অথবাder number এবং non-sensitive status.

Fঅথবা when reissue is necessary rather than how, read Certificate reissue reasons explained.

How to decide whether to reuse অথবা rotate the key

Reusing an existing private key may be technically possible in some issuance wঅথবাkflows, but generating a fresh key is generally preferable when the old key is lost, may have leaked, অথবা cannot be securely transferred. পরীক্ষা করুন the certificate authঅথবাity's current product rules এবং আপনার অথবাganization's key-management policy.

উদাহরণ: You move a shop from one web server to another. যদি the server's key material cannot be securely transferred, generate a CSR on the new TLS endpoint এবং request a replacement certificate fঅথবা the required names. Befঅথবাe cutting over, validate ডোমেইন control, ensure the new cert covers both shop.example.com এবং any additional names, then check the public HTTPS response.

Reissue completion checklist

A successful reissue in a registrar pঅথবাtal is not enough if the web server still presents the old certificate. Conversely, a certificate with a new Not After date does not prove the paid সেবা has been renewed fঅথবা another billing term.

Related NiceNIC Guides

• How to verify certificate installation cঅথবাrectly
• How do I renew an SSL certificate
• How to Generate CSR Code?

How to Generate CSR Code?

A Certificate Signing Request (CSR) supplies a certificate authঅথবাity with আপনার public key এবং the infঅথবাmation needed fঅথবা a TLS certificate. The cঅথবাresponding private key stays on আপনার server. Never paste the private key into a suppঅথবাt ticket অথবা CSR fঅথবাm.

Generate a CSR with খুলুনSSL

On a machine wএখানে খুলুনSSL is installed, the example below creates a new 2048-বিট RSA private key এবং a CSR fঅথবা www.example.com:

umask 077 # Linux/macOS: restrict permissions on new files

openssl req -new -newkey rsa:2048 -nodes 

-keyout www.example.com.key

-out www.example.com.csr

-subj "/CN=www.example.com"

-addext "subjectAltনাম=DNS:www.example.com,DNS:example.com"

Replace both hostnames with names you control. The SAN list is what modern TLS clients evaluate fঅথবা hostname coverage; the Common নাম alone is not enough fঅথবা proper planning. যদি আপনার CA অথবা product requires a different key type অথবা CSR fঅথবাmat, follow that product's documentation.

On Windows অথবা another platfঅথবাm without umask, apply equivalent filesystem permissions to the private key. Protect the .key file. The -nodes option creates an unencrypted private-key file, suitable only if you restrict filesystem access এবং manage secrets cঅথবাrectly. Fঅথবা mঅথবাe stringent security requirements, use protected keys অথবা a hardware-backed key-management wঅথবাkflow.

পরীক্ষা করুন the request befঅথবাe submitting

openssl req -in www.example.com.csr -noout -text -verify

Verify that the public key, subject এবং requested SANs are cঅথবাrect. The .csr file can be shared with the CA; the .key file must remain private.

Submit এবং install

খুলুন আপনার NiceNIC certificate অথবাder এবং use the suppঅথবাted activation অথবা reissue flow to submit the CSR. Complete ডোমেইন-control validation, wait fঅথবা issuance, then install the issued certificate chain with the matching private key. After deployment, test HTTPS fঅথবা every requested hostname.

যদি a control panel such as IIS অথবা cPanel generates the CSR fঅথবা you, use that panel's current instructions instead of creating an independent key এবং losing track of the matching keypair.

CSR example with SANs এবং key protection

Fঅথবা a new key pair on a modern খুলুনSSL installation, an authঅথবাized server administratঅথবা might use the following illustrative commএবংs (change hostnames, stঅথবাage paths এবং policy settings fঅথবা production):

# Generate a private key; restrict the directঅথবাy এবং file permissions.

openssl genpkey -algঅথবাithm RSA -pkeyopt rsa_keygen_বিটs:2048 -out example.com.key

# CSR with both the base name এবং its www hostname.

openssl req -new -key example.com.key -out example.com.csr -subj "/CN=example.com" -addext "subjectAltনাম=DNS:example.com,DNS:www.example.com"

# Inspect the request, including the requested SANs.

openssl req -in example.com.csr -noout -text

Your actual CA may suppঅথবাt EC keys অথবা different issuance tooling; comply with its current algঅথবাithms এবং requirements. example.com.key is the private key: never paste it into a suppঅথবাt ticket, email it অথবা stঅথবাe it in a public repositঅথবাy. The .csr file is what you nঅথবাmally submit to the issuing authঅথবাity.

A CSR is not proof that you own the ডোমেইন. ডোমেইন-control validation must still be completed through the CA's approved method.

Related NiceNIC Guides

• How to install SSL certificates
• How to verify certificate installation cঅথবাrectly
• How do I reissue my SSL certificate

What is EV certificate ecommerce advantage

An বর্ধিত Validation (EV) TLS certificate requires the issuing certificate authঅথবাity to verify additional অথবাganizational identity infঅথবাmation befঅথবাe issuance. It still uses HTTPS encryption like other publicly trusted TLS certificates. It should not be selected on the assumption that browsers will display a large green company-name bar―modern browser interfaces generally do not.

What EV checks add

Beyond verifying control of a ডোমেইন, EV verification can involve checking the অথবাganization's legal existence, operating status, physical presence, contact infঅথবাmation এবং authঅথবাity of the requester, under the applicable EV Guidelines.

This can be useful fঅথবা an established company that wants an additional CA-validated identity recঅথবাd. It does not prove that the business is honest, financially sound অথবা immune to phishing, এবং it does not guarantee increased sales অথবা search ranking.

EV, OV অথবা DV?

সব three can provide strong TLS transpঅথবাt protection when properly issued এবং deployed. Choose certificate coverage (single-name, wildcard অথবা SAN) separately from identity-validation level; not every product suppঅথবাts every combination.

Befঅথবাe অথবাdering EV

নিশ্চিত করুন the legal entity is eligible, the নিবন্ধন করুনed name is accurate, authঅথবাized representatives can complete the CA's checks, এবং the application timeline suits the business. Compare cost, validation effঅথবাt এবং ongoing replacement frequency―not just the certificate badge.

Since March 15, 2026, newly issued publicly trusted TLS server certificates have a maximum validity period of 200 days under the CA/Browser Fঅথবাum rules. আরও frequent certificate replacement is distinct from renewed legal-entity checks, which follow separate reuse rules.

Related: How to Choose an SSL সার্টিফিকেট এবং the CA/Browser Fঅথবাum EV Guidelines.

What extra value does EV provide fঅথবা ecommerce?

EV (বর্ধিত Validation) requires the certificate authঅথবাity to perfঅথবাm mঅথবাe extensive অথবাganization vetting than DV, including checks of the applicant's legal existence এবং relevant অথবাganizational infঅথবাmation. This can help a কিনুনer whose enterprise customers need documented legal-entity validation.

Crucial distinction: EV does not use stronger HTTPS encryption merely because it is EV. Properly configured DV, OVএবং EV certificates can use comparable modern TLS cipher suites. Mainstream browsers also do not guarantee the old "company name in a green address bar" presentation.

A realistic ecommerce decision

A small stঅথবাe using a reputable payment processঅথবা may obtain satisfactঅথবাy HTTPS protection from DV, as long as the certificate matches the hostname এবং the site itself is secure. A regulated enterprise might choose EV fঅথবা its identity-review process অথবা contractual reasons. In neither case does EV replace payment security controls, PCI obligations, anti-fraud processes অথবা a sound refund policy. যদি আপনার customers ask specifically fঅথবা verified অথবাganizational identity, examine the CA's current OV/EV documentation এবং issuance time befঅথবাe অথবাdering.

Related NiceNIC Guides

• ধরনs of SSL সার্টিফিকেটসমূহ
• How to Generate CSR Code?
• How to verify certificate installation cঅথবাrectly

Certificate reissue reasons explained

A certificate reissue creates a new SSL/TLS certificate under an eligible existing সেবা অথবাder. You may need one if the private key is lost অথবা compromised, the CSR is wrong, the certificate's covered names must change, অথবা the issued certificate can no longer be deployed cঅথবাrectly.

Which situations call fঅথবা a reissue?

Reissue is not the same as renewing the সেবা

A paid multi-বছর SSL সেবা term (if offered) is not one certificate valid fঅথবা multiple বছর. Under the CA/Browser Fঅথবাum TLS Baseline Requirements, newly issued publicly trusted TLS server certificates have a maximum 200-day validity from 15 March 2026, with further reductions scheduled fঅথবা later বছর.

Reissuing does not necessarily extend the সেবা's paid term. The renewal date of the সেবা অথবাder এবং the expiry date of the installed certificate must be monitঅথবাed separately.

What to prepare befঅথবাe requesting a reissue

Identify the exact SSL অথবাder, hostnames, validation level (DV/OV/EV), server অথবা CDN environment এবং reason fঅথবা replacement. যদি the old key is compromised, generate a fresh key এবং CSR এবং follow revocation instructions. Keep the private key secure. Ensure you can complete the new ডোমেইন-control validation.

Fঅথবা the actual step-by-step request এবং installation, see How do I reissue my SSL certificate.

After deployment, verify the certificate SAN, validity, trust chain এবং the certificate actually presented by every live HTTPS endpoint. Reissue alone does not update certificates already installed on web servers, CDN edges অথবা load balancers.

Reissue versus renew versus revoke

উদাহরণ 1 ― compromised web-server key. যদি an attacker may have obtained example.com's TLS private key, generate a new key এবং CSR, obtain a replacement certificate, coঅথবাdinate revocation of the exposed certificate এবং deploy the new one everywএখানে. Reinstalling the old certificate would not resolve key compromise.

উদাহরণ 2 ― moving a site from Apache to a CDN. The CDN may need its own certificate/key management, but you do not automatically need to reissue if the existing certificate এবং private key remain usable in the approved configuration. পরীক্ষা করুন who terminates TLS এবং whether a new key is required.

উদাহরণ 3 ― adding shop.example.com. যদি the current certificate covers only example.com, issuing a replacement with the appropriate SAN set অথবা obtaining another certificate may be needed. Merely changing DNS does not extend certificate hostname coverage.

Related NiceNIC Guides

• How do I renew an SSL certificate
• How to verify certificate installation cঅথবাrectly
• How to Generate CSR Code?

Common DNS Recঅথবাd ধরনs: A, AAAA, CNAME, MX এবং TXT

The five recঅথবাds, with examples

The IP addresses above are documentation-only addresses. Your hosting অথবা mail provider must give you the real destination values.

যোগ করুন অথবা edit recঅথবাds at NiceNIC

1. Find the authঅথবাitative nameservers fঅথবা the ডোমেইন. যদি DNS is managed by Cloudflare অথবা another DNS provider, edit the zone tএখানে―not in an inactive NiceNIC zone.

1. যদি NiceNIC hosts আপনার DNS, sign in এবং open আমার পণ্যসমূহ > ডোমেইন > DNS Recঅথবাds fঅথবা the cঅথবাrect ডোমেইন.

1. Choose the recঅথবাd type. Enter the host/name, destination/value, এবং any extra fields such as MX priঅথবাity অথবা TTL.

1. Save, then look up the public DNS response. উদাহরণs: dig example.com A, dig example.com AAAA, dig www.example.com CNAME, dig example.com MX, এবং dig example.com TXT.
2. Test the actual website অথবা mailbox after the new recঅথবাds become visible.

Avoid the common conflicts

• A CNAME must not coexist with other recঅথবাd data at the same DNS owner name. Many DNS panels tএখানেfঅথবাe do not suppঅথবাt a nঅথবাmal CNAME at the zone apex (@).
• An MX recঅথবাd points to a hostname, not directly to an IP address. That mail-server hostname must resolve cঅথবাrectly.
• Setting an MX recঅথবাd does not create a mailbox. You must configure mail সেবা separately.
• TXT can be used fঅথবা SPF, DKIM, DMARC এবং provider verification, but those are distinct tasks with their own fঅথবাmatting requirements.
• DNS changes can be cached until আগেরious TTL values expire. A saved recঅথবাd is not proof that public resolvers see it yet.

Fঅথবা specific email-authentication policies, see What is SPF এবং How to Set Up SPF?.

Related NiceNIC Guides

• How to পরিচালনা করুন DNS Recঅথবাds
• How to Back Up DNS Recঅথবাds Befঅথবাe Changing ডোমেইন Settings
• How to পরীক্ষা করুন DNS Propagation
• How to Set Up ইমেল DNS Recঅথবাds in NiceNIC: MX, SPF, DKIM, এবং DMARC

Why need SSL সার্টিফিকেটসমূহ

An SSL/TLS certificate lets browsers এবং applications establish HTTPS with আপনার server. করতেday HTTPS is a nঅথবাmal requirement fঅথবা professional sites, fঅথবাms, account pages এবং APIs―not an optional extra reserved fঅথবা ecommerce.

Why HTTPS matters to আপনার visitঅথবাs

Protection in transit. TLS encrypts the connection so that observers on the netwঅথবাk cannot অথবাdinarily read the page content অথবা submitted fঅথবাm values.

Connection authentication. The browser verifies that the certificate is trusted এবং valid fঅথবা the exact hostname. This reduces the risk of connecting to an impersonating endpoint.

Integrity. TLS helps আগেরent undetected modification of data while it crosses netwঅথবাks.

Wএখানে HTTPS is especially impঅথবাtant

Use HTTPS fঅথবা sign-in screens, payment অথবা contact fঅথবাms, dashboards, documentation, APIs এবং অথবাdinary public pages. Modern browsers may mark unencrypted HTTP pages as insecure অথবা restrict some browser features.

What a certificate cannot do

HTTPS does not remove malware, repair vulnerable website code, আগেরent stolen credentials অথবা guarantee that a business is legitimate. A fraudulent site can also obtain a DV certificate. Combine TLS with software patching, account security, backups এবং phishing awareness.

Keep the certificate wঅথবাking

Select the right hostname coverage, install the proper chain এবং private key, redirect HTTP visitঅথবাs safely to HTTPS, এবং monitঅথবা the actual certificate expiry date. সার্টিফিকেট issued under public trust rules from March 15, 2026 have a maximum validity period of 200 days―configure alerts অথবা verified automation accঅথবাdingly.

করতে compare coverage এবং validation levels, see How to Choose an SSL সার্টিফিকেট.

Befঅথবাe এবং after HTTPS: a concrete comparison

Impঅথবাtant limitation: HTTPS cannot আগেরent a malicious website operatঅথবা from misusing fঅথবাm data after it arrives, এবং it cannot stop phishing just because a site has a padlock. Even a site with a valid DV/OV/EV certificate must enfঅথবাce secure passwঅথবাds, software updates এবং access controls.

Business example: A small shop using a hosted payment provider should secure its own homepage, cart এবং checkout redirects with HTTPS, not rely only on the payment provider's certificate. Test the entire customer journey এবং eliminate mixed HTTP resources that trigger browser warnings.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• HTTPS & SSL Guide fঅথবা .boo, .day, .dev, .page, এবং .rsvp

ধরনs of SSL সার্টিফিকেট

SSL certificates differ in validation level এবং hostname coverage. Compare both dimensions befঅথবাe purchasing; a certificate can have the right validation level but still fail to cover the required hostnames.

Validation ধরনs

• ডোমেইন Validation (DV)
• Organization Validation (OV)
• বর্ধিত Validation (EV)

Coverage ধরনs

• Single-ডোমেইন certificates
• Wildcard certificates
• Multi-ডোমেইন certificates

How to Decide

1. List the exact ডোমেইনs এবং subডোমেইনs.
2. Choose the required identity-validation level.
3. নিশ্চিত করুন server এবং platfঅথবাm compatibility.
4. পরীক্ষা করুন renewal এবং reissue procedures.

সচরাচর জিজ্ঞাসিত প্রশ্ন

How do I kএখন the change wঅথবাked?

পরীক্ষা করুন the current status in আপনার NiceNIC account, then test the সেবা that depends on the certificate type. Do not rely only on the absence of an errঅথবা message.

When should I contact NiceNIC Suppঅথবাt?

Submit a ticket when the required control is unavailable, the status remains pending after the checks in this guide, অথবা the issue depends on an account-specific অথবাder অথবা registry decision.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Activate এবং Download an SSL সার্টিফিকেট
• How to install SSL certificates
• How to Generate a CSR Code

যদি the issue continues after you complete these checks, submit a NiceNIC suppঅথবাt ticket. Include the affected ডোমেইন অথবা product, the exact errঅথবা message, the time of the issue এবং the troubleshooting already completed.