How do I reissue my SSL certificate
Use Reissue when you need a replacement SSL/TLS certificate under an eligible NiceNIC certificate order—for example, after losing the matching private key or correcting certificate details. If you are only moving hosts and still control the matching private key, reinstalling the existing unexpired certificate may be sufficient.
Reissue through your NiceNIC SSL order
- Sign in to NiceNIC and locate the exact SSL certificate order. Record the covered hostnames, current certificate expiration and paid service term.
- Open the available Reissue or certificate-management action for that order. If you cannot see such a control, use the Human Support button on the article instead of purchasing a duplicate SSL product.
- Decide whether the current private key is safe. If lost or compromised, generate a new key and CSR. Never send the private key to NiceNIC, a certificate authority or a support agent.
- Verify the CSR's Subject Alternative Names (SANs) and submit it through the authorized reissue workflow.
- Complete the certificate authority's domain-control validation. OV/EV products may also require updated organization checks.
- Download the newly issued certificate plus the necessary intermediate certificates or chain.
- Install the replacement certificate on the actual TLS endpoint (hosting server, reverse proxy, CDN or load balancer) with the matching private key.
- Verify the deployed certificate's SANs, issuer chain and Not After date from outside your network. Check all relevant hostnames and server nodes before removing the old working deployment.
If the previous key was compromised, follow the certificate authority's revocation procedure for the affected certificate—not merely a local file deletion.
Why the expiration date may not match your paid subscription
Since 15 March 2026, newly issued publicly trusted TLS server certificates have been limited to 200 days of validity under the CA/Browser Forum rules. A longer paid service term may require multiple certificate replacements. A reissue does not by itself extend the paid subscription.
Reissue troubleshooting
- The server reports a key mismatch: the installed private key does not match the new certificate/CSR.
- Validation is pending: check DNS/HTTP challenge data at the authoritative DNS provider or site, as instructed by the issuing CA.
- The browser still shows the old certificate: inspect CDN edges, multiple web-server nodes, SNI and whether the service was reloaded.
- No Reissue action appears: check the product's eligibility and send NiceNIC Support the SSL order number and non-sensitive status.
For when reissue is necessary rather than how, read Certificate reissue reasons explained.
How to decide whether to reuse or rotate the key
Reusing an existing private key may be technically possible in some issuance workflows, but generating a fresh key is generally preferable when the old key is lost, may have leaked, or cannot be securely transferred. Check the certificate authority's current product rules and your organization's key-management policy.
Example: You move a shop from one web server to another. If the server's key material cannot be securely transferred, generate a CSR on the new TLS endpoint and request a replacement certificate for the required names. Before cutting over, validate domain control, ensure the new cert covers both shop.example.com and any additional names, then check the public HTTPS response.
Reissue completion checklist
Not After
A successful reissue in a registrar portal is not enough if the web server still presents the old certificate. Conversely, a certificate with a new Not After date does not prove the paid service has been renewed for another billing term.
