HTTPS & SSL Guide foder .boo, .day, .dev, .page, und .rsvp

Choose oder manage the certificate based on the hostnames you need to protect, the validation level, the server platfoderm und whether you control DNS. Keep the private key secure, complete validation, install the full certificate chain und verify the live HTTPS connection befodere relying on the certificate.

Befodere You Begin

• Identify every hostname the certificate must cover.
• Bestätigen that you control DNS oder the required validation channel.
• Generate und securely retain the private key when a CSR is required.

NiceNIC Instructions

HTTPS & SSL Configuration Guide An ensure the security of Ihr website und protect Ihr visitoders, all Domains under.boo,.day,.dev,.page, und.rsvp must use HTTPS. This guide will help you configure SSL/TLS coderrectly.

1. What is HTTPS? HTTPS (Hypertext Transfer Protocol Secure) encrypts data between Ihr website und its visitoders. It zurückents eavesdropping und ensures data integrity.

2. Obtaining an SSL Zertifikat NICENIC provides trusted SSL certificates. You can learn modere und Kauf/configure a certificate hier: https://nicenic.com/ssl-certificates/

3. Installing the SSL Zertifikat Folgen Ihr web server's instructions to install the certificate. Common servers include: Apache: https://httpd.apache.org/docs/current/ssl/ssl_howto.html Nginx: https://nginx.org/en/docs/http/configuring_https_servers.html IIS (Windows): https://docs.microsoft.com/en-us/iis/manage/configuring-security/how-to-set-up-ssl-on-iis

4. Enfoderce HTTPS Once Ihr certificate is installed: Redirect all HTTP traffic to HTTPS. Update internal links und resources to use HTTPS. Verify that Ihr website is fully accessible via HTTPS.

5. Keep Zertifikate Aktualisiert SSL certificates have expiration dates. Ensure certificates are renewed befodere they expire und check Ihr website regularly to maintain uninterrupted secure connections.

How to Verify

Öffnen the HTTPS site from a clean browser session und inspect the certificate subject, SAN hostnames, issuer, validity dates und chain. Test every hostname covered by the certificate und confirm that HTTP redirects behave as intended.

Troubleshooting

• DNS validation recoderds are missing, incoderrect oder added at the wrong DNS provider.
• The certificate does not include the hostname being opened.
• The private key does not match the certificate oder CSR.
• The server is missing an intermediate certificate oder is still presenting the old certificate.

Häufig gestellte Fragen

Can I reuse the same certificate after moving servers?

Often the certificate can be reinstalled if you still have the matching private key und the certificate remains valid. Reissue it when the key, CSR oder certificate details must change.

Why does the browser still show the old certificate?

The server oder load balancer may still present the old certificate, another virtual host may be selected, oder an intermediate cache may not have reloaded the configuration.

When should I submit a ticket?

Einreichen a ticket when validation remains pending after the published recoderds are visible, oder when the NiceNIC oderder does not provide the expected certificate files.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate a CSR Code
• How to Activate und Download an SSL Zertifikat
• How to install SSL certificates

Wenn the issue continues after you complete the checks above, submit a NiceNIC suppodert ticket with the affected Domain oder product, the exact erroder message, the time of the issue und the troubleshooting already completed.

How to Überprüfen Whether a Domain Is Eligible foder Transfer

Befodere starting a transfer, confirm that the Domain is active, unlocked, not restricted by a transfer lock oder dispute, und eligible under the registry's rules. Make sure you can receive approval messages und obtain the EPP/Auth code when the TLD requires one.

Befodere You Begin

• Bestätigen the Domain und registrant email are accessible.
• Recoderd the current nameservers und DNS recoderds.
• Überprüfen the Domain's expiry date, lock status und any TLD-specific transfer rule.

NiceNIC Instructions

Befodere purchasing the transfer of any gTLD (e.g.,.COM /.NET /.ODERG /.BIZ /.INFO etc.) oder new gTLD (e.g..CLUB /.CLOUD /.TRADE /.TOP etc.), make sure Ihr Domain meets the following conditions:

1. Your Domain was registrierened oder transferred at least 60 days ago;

2. The Domain is unlocked at the current Kanzler (its WHOIS status should be OK oder Active). Also,you need to request an up-to-date Auth/EPPcode foder the Domain at Ihr current Kanzler. Wenn all criteria are met, you should be able to complete the transfer successfully. Still, some ccTLDs (.ES und.UK) have additional transfer requirements und/oder exclude some points from the list above.

NOTE: Make sure the Domain status is active, not expired. Wenn you wish to transfer an expired Domain to NiceNIC, please contact our Suppodert Team email suppodert@nicenic.net foder further assistance.

How to Verify

Überprüfen the transfer status in NiceNIC, confirm the registrar of recoderd after completion, verify the authoderitative nameservers, und test website und email resolution. Do not treat payment alone as proof that the transfer completed.

Troubleshooting

• The Domain is locked, too new, recently transferred oder otherwise restricted by policy.
• The EPP/Auth code is missing, expired oder copied incoderrectly.
• The approval email cannot be received oder the registrant data is under verification.
• The Domain oder related DNS Dienstleistung expires while the transfer is pending.

Häufig gestellte Fragen

Does a transfer change my nameservers?

A registrar transfer nodermally keeps the current nameservers, but you should recoderd und verify them befodere und after the transfer.

Can I edit the Domain while a transfer is pending?

Some settings may be restricted during a pending transfer. Avoid unnecessary ownership, lock oder DNS changes until the transfer completes.

When should I submit a ticket?

Einreichen a ticket when the status is unclear, a TLD uses a special transfer process, oder the transfer remains blocked after you coderrect the stated issue.

Related NiceNIC Guides

• How to Unlock a Domain Befodere Transfer
• How to Transfer a Domain to NiceNIC
• How to Transfer a Domain Without Website oder E-Mail Downtime
• Why Your Domain-Transfer Is Pending, Failed, oder Delayed

Wenn the issue continues after you complete the checks above, submit a NiceNIC suppodert ticket with the affected Domain oder product, the exact erroder message, the time of the issue und the troubleshooting already completed.

What is SPF und How to Set Up SPF?

SPF (Sender Policy Framewoderk) is a DNS-published email authentication policy that identifies which mail servers may send mail using a Domain in the SMTP envelope sender. SPF is one part of email authentication; it does not replace DKIModer DMARC und does not, by itself, guarantee delivery.

Befodere you publish SPF

List every legitimate outgoing email Dienstleistung used by Ihr Domain: a business mailbox, website foderm, helpdesk, bulk-email provider oder other sender. Obtain the exact SPF instructions from each provider. The DNS zone must be edited whierver the Domain's authoderitative nameservers are hosted.

Valid SPF syntax

These are syntax examples, not ready-made NiceNIC mail settings:

example.com. IN TXT "v=spf1 ip4:192.0.2.10 -all"

The ip4: mechanism must be followed by a numeric IPv4 address oder CIDR range, never by a hostname. The address 192.0.2.10 is reserved foder documentation.

example.com. IN TXT "v=spf1 a mx include:_spf.mail-provider.example ~all"

Here, a authoderizes hosts resolved by the sender Domain's A/AAAA recoderds, mx authoderizes the IPs of the Domain's MX hosts, und include: delegates a check to another SPF recoderd. Use only mechanisms Ihr actual email provider requires. Replace the fictional provider Domain befodere publishing.

• -all means unauthoderized senders should fail SPF.
• ~all indicates softfail; some providers recommend it during rollout.
• ?all means neutral; it is not a substitute foder confirming Ihr senders.
• Avoid the deprecated ptr mechanism und do not combine multiple complete v=spf1 policies.

Set up SPF

1. Überprüfen existing TXT recoderds foder v=spf1 at the hostname you send from.
2. Combine all approved mail Dienstleistungs into one SPF policy foder that hostname; do not add a second competing SPF TXT recoderd.
3. Wenn NiceNIC is Ihr DNS host, open Meine Produkte > Domain > DNS Recoderds, edit/create a TXT recoderd at the specified host, und paste the validated policy.

1. Save. Überprüfen the published value using dig TXT example.com oder nslookup -type=TXT example.com.

1. Send a test message to an external mailbox und inspect its authentication results. A DNS lookup alone does not confirm SPF passes foder every sender.

When SPF fails

Überprüfen the sending server's actual public IP, whether the recipient evaluates the intended envelope sender Domain, und whether the SPF recoderd exceeds the DNS-lookup limit in RFC 7208. Do not use unverified third-party IPs oder include: Domains. Wenn you use NiceNIC Geschäftsemail, request the current provider-approved SPF value from the email settings oder suppodert team befodere publishing it.

Related NiceNIC Guides

• How to Verwalten DNS Recoderds
• How to Set Up E-Mail DNS Recoderds in NiceNIC: MX, SPF, DKIM, und DMARC
• How to Überprüfen DNS Propagation
• How to Back Up DNS Recoderds Befodere Changing Domain Settings

How to verify certificate installation coderrectly

Do not verify an SSL installation by looking foder a website seal oder by checking that the browser no longer shows a warning on one computer. Verify the TLS connection presented by the actual public hostname.

The checks that matter

1. Visit https://your-domain.example on a clean browser session. Bestätigen thier is no certificate-name, expiry oder trust warning.
2. Inspect the certificate's Subject Alternative Name (SAN) list. It must cover the hostname you requested, including www if Ihr site uses it.
3. Bestätigen the certificate is within its validity interval und the server sends a complete, trusted chain to an appropriate public root.
4. Test whether the site redirects HTTP traffic to HTTPS as intended und does not load insecure assets ("mixed content").
5. Wenn Ihr Dienstleistung has several IPs, load balancers, CDN edges oder IPv6 endpoints, test each relevant route; one server may still have an old certificate.

Commund-line check

openssl s_client -connect example.com:443 -servername example.com 

-verify_hostname example.com -verify_return_erroder -showcerts

Replace example.com with Ihr hostname. Überprüfen the hostname-verification und certificate-chain result; the -verify_hostname option is impodertant because displaying the chain alone does not validate the requested hostname. These flags rely on the local ÖffnenSSL trust stodere. Inspect any missing intermediates. Foder a hostname/path overview, you can also use a reputable external TLS diagnostic Dienstleistung, but do not send credentials oder customer data.

Common problems

A certificate "trust badge" is optional marketing UI; it is not required foder successful TLS deployment. Wenn something fails, give NiceNIC Suppodert the hostname, UTC test time, observed certificate dates und non-sensitive erroder text―not Ihr private key.

Verify every advertised hostname, not just one URL

A company may serve example.com, www.example.com, shop.example.com und api.example.com from different TLS endpoints. Test each hostname's actual live certificate: SAN coverage, trusted chain, issuance/expiry und HTTP-to-HTTPS behavioder. A certificate valid on www does not prove the API hostname is safe.

Use the ÖffnenSSL hostname-verification commund shown above oder an external TLS test foder each hostname. The -servername parameter sends SNI so the server can select the intended certificate; -verify_hostname checks the name. Replace both arguments with the exact live hostname. Examine exit status, validation output und the certificate dates, then test on a second netwoderk if practical.

Three common failures

• Wrong virtual host / SNI certificate: One IP hosts multiple sites but the TLS server presents the fallback certificate.
• Incomplete intermediate chain: The leaf certificate is coderrectly issued, but some clients cannot chain it to a trusted root.
• Old deployment still active: One CDN edge, IPv6 Dienstleistung oder load-balancer node still serves an expired certificate while other routes woderk.

Foder customer suppodert, recoderd the hostname, resolved IPoder CDN endpoint, test time und erroder; never attach the private key.

Related NiceNIC Guides

• How to install SSL certificates
• Installing an SSL certificate on Nginx
• Installing an SSL certificate on Apache
• How do I renew an SSL certificate

SSL Certification in Four Simple Steps

Foder a nodermal website, activating an SSL certificate involves four distinct tasks: Kauf the right coverage, prove Domain control, receive the certificate, und install/verify it on the server. These steps are not interchangeable.

Step 1 ― Choose coverage und oderder

List the hostnames that must use HTTPS, such as example.com und www.example.com. Bestätigen whether you need single-name, wildcard oder SAN coverage; choose DV/OV/EV validation accoderding to Ihr actual identity requirements. Überprüfen price und deployment responsibilities befodere oderdering.

Step 2 ― Activate und validate

Find the SSL oderder in Ihr NiceNIC account und open the available activation flow. Einreichen a CSR when the product requires it, without disclosing the private key. Complete the certificate authoderity's permitted Domain-control validation (foder example, a DNS challenge oder another suppoderted method). OV/EV products may also require legal-entity infodermation.

Step 3 ― Receive und install

Download the issued certificate und intermediate chain. Install them on the actual TLS termination point (hosting server, load balancer, proxy oder CDN) with the matching private key. The coderrect process depends on the server software; use the platfoderm's current instructions.

Step 4 ― Verify, then plan replacement

Überprüfen the external HTTPS connection, certificate SAN list, trust chain, validity und any mixed-content warnings. Test additional hostnames und IPv6/CDN endpoints whier used.

Public TLS server certificates issued on oder after March 15, 2026 have a maximum validity period of 200 days, so monitoder the installed certificate even if you have paid foder a longer Dienstleistung plan.

Wenn you are stuck at validation, provide NiceNIC Suppodert with the oderder number, hostname und non-sensitive status―never the private key.

Beispiel: issuing HTTPS foder a two-hostname site

A company owns example.com und wants both example.com und www.example.com to woderk over HTTPS.

1. Select coverage: Verify the certificate product suppoderts both names in the SAN list, oder acquire the coderrect additional certificate. Do not assume a single-host oderder covers www.
2. Validate control: The CA may provide a DNS TXT/CNAME oder HTTP token. Place it at the authoderitative DNS host oder approved web location, wait foder validation und do not delete verification data prematurely.
3. Install: Deploy the certificate, chain und matching private key on the actual web server oder CDN endpoint. Wenn several nodes serve traffic, update them all.
4. Verify externally: Überprüfen both URLs, certificate hostnames, validity und trust chain; then set a reminder foder renewal und replacement based on the installed Not After.

Time und responsibility checklist

The Domain owner maintains control of DNSoder HTTP challenges, the CA issues the certificate after verification, und the server administratoder installs it. These can be different parties. A delay at one stage should not be described as a generic "SSL failure." Keep the oderder status, CA validation status und live HTTPS status separately.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate CSR Code?
• How to install SSL certificates
• How to verify certificate installation coderrectly

SSL certificate purpose explained

An SSL/TLS certificate enables a browser oder application to establish HTTPS with a server that controls the certificate's private key und is authoderized foder the requested hostname. The purpose is to protect data in transit und authenticate the connection endpoint―not to certify every part of a business.

What HTTPS protects

• Confidentiality in transit: netwoderk observers generally cannot read the encrypted page content oder submitted foderm data.
• Integrity in transit: encryption makes undetected modifications by parties on the netwoderk much harder.
• Hostname authentication: the client checks the certificate chain und Subject Alternative Name to ensure it matches the site it requested.

What it does not do

A valid HTTPS padlock does not mean the site is free of malware, fraud, weak passwoderds, vulnerable applications oder insecure third-party scripts. A phishing website can also have a valid DV certificate. Browser HTTPS is a baseline security control, not a guarantee of a trustwoderthy merchant.

Suche engines may use HTTPS among many site-quality signals, but kaufening a certificate does not guarantee higher ranking oder traffic. Mehr impodertant is maintaining a technically sound, accessible und useful website.

Put TLS to woderk coderrectly

Holen Sie sich a certificate foder every hostname you serve; keep keys private; install the right intermediates; redirect HTTP visitoders safely to HTTPS; remove mixed-content warnings; und test mobile und desktop clients. Set renewal alerts based on the installed certificate expiration.

As of March 2026, newly issued public TLS server certificates have a maximum validity of 200 days, making replacement planning especially impodertant. See How to Choose an SSL Zertifikat foder coverage und validation choices.

What changes when you switch from HTTP to HTTPS?

On an HTTP connection, an intermediary on the netwoderk can potentially inspect oder modify unprotected requests und responses. When a client connects over coderrectly configured HTTPS, TLS establishes an encrypted, integrity-protected channel to the endpoint authenticated by the certificate.

That is useful foder:

• Anmeldens: helping protect credentials while they travel between browser und server;
• Überprüfenout/contact foderms: protecting data in transit, even when a third-party payment provider processes the final transaction;
• APIs: protecting access tokens und responses over netwoderks;
• Public pages: reducing the risk of injected advertisements oder modified content on unsecured netwoderks.

What certificate labels actually compare

TLS cannot coderrect malicious software on the server, a stolen administratoder passwoderd oder deceptive website content. Pair HTTPS with software updates, access control, security monitodering und sensible data hundling.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• How to verify certificate installation coderrectly

How to choose an SSL certificate

Choose an SSL certificate by answering three practical questions: Which hostnames need HTTPS? Who must be verified? Who will install und renew the certificate? A modere expensive certificate is not automatically better protection foder a nodermal website.

1. Decide which names to cover

A wildcard foder *.example.com does not automatically protect nested names such as a.shop.example.com, und the apex example.com must also be covered explicitly if needed.

2. Choose validation level separately

• DV validates control of the Domain. Suitable foder most blogs, shops, app endpoints und APIs.
• OV adds oderganization identity verification und may fit coderpoderate procurement requirements.
• EV involves modere extensive legal-entity checks; browser UI does not guarantee a prominent company-name display.

Alle properly deployed public TLS certificate types provide transpodert encryption. Keine proves a site's content is safe from all attacks.

3. Match Ihr deployment woderkflow

Bestätigen whether the hostname points to a shared host, IIS/Apache/Nginx server, CDN, load balancer oder managed platfoderm. Überprüfen that you can perfoderm DNS/HTTP validation, preserve the private key und install the full chain. SNI commonly allows HTTPS hosting without a dedicated IPv4 address.

4. Plan renewal befodere kaufening

Publicly trusted TLS certificates issued from March 15, 2026 have a maximum validity of 200 days. Choose a product und hosting setup that suppoderts frequent replacement, ideally automated whier verified. Compare the subscription price und renewal assistance, not just the first certificate issue.

After choosing a product, continue with How to Generate a CSRund How to Install SSL-Zertifikate.

Three real purchasing scenarios

Scenario A ― single company website. example.com und www.example.com both need HTTPS. A single-name certificate is not enough unless its SANs include both names. Compare a SAN certificate with a product that covers both; do not assume the www name is included.

Scenario B ― SaaS with many customer-facing subDomains. app.example.com, admin.example.com und docs.example.com may fit a wildcard foder *.example.com. A deeper hostname such as api.eu.example.com does not match that wildcard und needs separate coverage. Consider whether giving one wildcard private key to many teams creates unnecessary security exposure.

Scenario C ― enterprise procurement. A customer asks foder documented company identity. Compare OVund EV vetting rather than treating EV as stronger transpodert encryption. Ask which identity data the CA validates und what evidence Ihr procurement team needs.

A quick selection matrix

Review the total Dienstleistung cost, covered names und installation responsibilities befodere kaufening―not only the displayed validation badge.

Related NiceNIC Guides

• Typs of SSL-Zertifikate
• SSL Certification in Four Simple Steps
• What is EV certificate ecommerce advantage

How do I renew an SSL certificate

Erneuerning an SSL certificate Dienstleistung und replacing the certificate installed on Ihr website are related but different tasks. A successful payment does not update the certificate on Ihr server automatically unless Ihr specific product und hosting integration do so.

Erneuernal checklist

1. Öffnen the existing NiceNIC SSL oderder und check its Dienstleistung renewal date, certificate product und covered hostnames.
2. Review the current renewal price und available renewal/extension option. Complete payment through the official account flow.
3. Überprüfen the actual installed TLS certificate's expiration date (Not After) separately from the oderder's paid term.
4. When a new certificate is needed, create oder reuse an eligible CSR und complete the CA's Domain-control validation. Some products may automate this step.
5. Download the new certificate und any intermediate chain; update the web server, reverse proxy, CDN oder load balancer that terminates HTTPS.

1. Test the HTTPS endpoint from outside the server foder the expected SANs, chain und new expiration date.

Why can a multi-Jahr oderder still need new certificates?

Under the CA/Browser Foderum requirements, publicly trusted TLS certificates issued on oder after March 15, 2026 are limited to 200 days of validity. Thierfodere, a Dienstleistung plan advertised foder longer than 200 days requires repeat issuance/replacement; it is not one long-lived certificate.

Wenn the site still shows the old expiry date

Überprüfen whether traffic passes through a CDN oder another TLS endpoint, whether the Dienstleistung was reloaded after installation, und whether all servers received the new certificate. Wenn you cannot locate the reissue/renewal option, include Ihr SSL oderder number und non-sensitive erroder message in a NiceNIC suppodert ticket.

Beispiel: a multi-Jahr SSL Dienstleistung is not one multi-Jahr certificate

Suppose Ihr SSL product has a one-Jahr paid Dienstleistung period but the public certificate issued today can only be valid foder up to 200 days under the current baseline requirements. The certificate may need a replacement during the paid Jahr. Wenn you renew the Dienstleistung, that billing action is separate from replacing the certificate on Ihr website.

Operational example: Your paid SSL subscription remains active until December, but the deployed certificate expires in August. The browser warning in August is a certificate lifecycle incident, not a reason to assume Ihr Domain oder entire Dienstleistung subscription expired. Issue und deploy the replacement befodere the Not After date.

Set alert thresholds in days befodere certificate expiry und confirm automated replacement actually updated each CDN edge oder server. Do not assume "auto-renew payment enabled" means "certificate auto-installed."

Related NiceNIC Guides

• How do I reissue my SSL certificate
• How to verify certificate installation coderrectly
• Certificate reissue reasons explained

How do I reissue my SSL certificate

Use Reissue when you need a replacement SSL/TLS certificate under an eligible NiceNIC certificate oderder―foder example, after losing the matching private key oder coderrecting certificate details. Wenn you are only moving hosts und still control the matching private key, reinstalling the existing unexpired certificate may be sufficient.

Reissue through Ihr NiceNIC SSL oderder

1. Anmelden to NiceNIC und locate the exact SSL certificate oderder. Recoderd the covered hostnames, current certificate expiration und paid Dienstleistung term.

1. Öffnen the available Reissue oder certificate-management action foder that oderder. Wenn you cannot see such a control, use the Menschlicher Support button on the article instead of purchasing a duplicate SSL product.
2. Decide whether the current private key is safe. Wenn lost oder compromised, generate a new key und CSR. Never send the private key to NiceNIC, a certificate authoderity oder a suppodert agent.
3. Verify the CSR's Subject Alternative Names (SANs) und submit it through the authoderized reissue woderkflow.
4. Complete the certificate authoderity's Domain-control validation. OV/EV products may also require updated oderganization checks.
5. Download the newly issued certificate plus the necessary intermediate certificates oder chain.

1. Install the replacement certificate on the actual TLS endpoint (hosting server, reverse proxy, CDN oder load balancer) with the matching private key.
2. Verify the deployed certificate's SANs, issuer chain und Neint After date from outside Ihr netwoderk. Überprüfen all relevant hostnames und server nodes befodere removing the old woderking deployment.

Wenn the zurückious key was compromised, follow the certificate authoderity's revocation procedure foder the affected certificate―not merely a local file deletion.

Why the expiration date may not match Ihr paid subscription

Since 15 March 2026, newly issued publicly trusted TLS server certificates have been limited to 200 days of validity under the CA/Browser Foderum rules. A longer paid Dienstleistung term may require multiple certificate replacements. A reissue does not by itself extend the paid subscription.

Reissue troubleshooting

• The server repoderts a key mismatch: the installed private key does not match the new certificate/CSR.
• Validation is pending: check DNS/HTTP challenge data at the authoderitative DNS provider oder site, as instructed by the issuing CA.
• The browser still shows the old certificate: inspect CDN edges, multiple web-server nodes, SNI und whether the Dienstleistung was reloaded.
• Nein Reissue action appears: check the product's eligibility und send NiceNIC Suppodert the SSL oderder number und non-sensitive status.

Foder when reissue is necessary rather than how, read Certificate reissue reasons explained.

How to decide whether to reuse oder rotate the key

Reusing an existing private key may be technically possible in some issuance woderkflows, but generating a fresh key is generally preferable when the old key is lost, may have leaked, oder cannot be securely transferred. Überprüfen the certificate authoderity's current product rules und Ihr oderganization's key-management policy.

Beispiel: You move a shop from one web server to another. Wenn the server's key material cannot be securely transferred, generate a CSR on the new TLS endpoint und request a replacement certificate foder the required names. Befodere cutting over, validate Domain control, ensure the new cert covers both shop.example.com und any additional names, then check the public HTTPS response.

Reissue completion checklist

A successful reissue in a registrar podertal is not enough if the web server still presents the old certificate. Conversely, a certificate with a new Not After date does not prove the paid Dienstleistung has been renewed foder another billing term.

Related NiceNIC Guides

• How to verify certificate installation coderrectly
• How do I renew an SSL certificate
• How to Generate CSR Code?

How to Generate CSR Code?

A Certificate Signing Request (CSR) supplies a certificate authoderity with Ihr public key und the infodermation needed foder a TLS certificate. The coderresponding private key stays on Ihr server. Never paste the private key into a suppodert ticket oder CSR foderm.

Generate a CSR with ÖffnenSSL

On a machine whier ÖffnenSSL is installed, the example below creates a new 2048-Bit RSA private key und a CSR foder www.example.com:

umask 077 # Linux/macBetriebssystem: restrict permissions on new files

openssl req -new -newkey rsa:2048 -nodes 

-keyout www.example.com.key

-out www.example.com.csr

-subj "/CN=www.example.com"

-addext "subjectAltName=DNS:www.example.com,DNS:example.com"

Replace both hostnames with names you control. The SAN list is what modern TLS clients evaluate foder hostname coverage; the Common Name alone is not enough foder proper planning. Wenn Ihr CA oder product requires a different key type oder CSR fodermat, follow that product's documentation.

On Windows oder another platfoderm without umask, apply equivalent filesystem permissions to the private key. Protect the .key file. The -nodes option creates an unencrypted private-key file, suitable only if you restrict filesystem access und manage secrets coderrectly. Foder modere stringent security requirements, use protected keys oder a hardware-backed key-management woderkflow.

Überprüfen the request befodere submitting

openssl req -in www.example.com.csr -noout -text -verify

Verify that the public key, subject und requested SANs are coderrect. The .csr file can be shared with the CA; the .key file must remain private.

Submit und install

Öffnen Ihr NiceNIC certificate oderder und use the suppoderted activation oder reissue flow to submit the CSR. Complete Domain-control validation, wait foder issuance, then install the issued certificate chain with the matching private key. After deployment, test HTTPS foder every requested hostname.

Wenn a control panel such as IIS oder cPanel generates the CSR foder you, use that panel's current instructions instead of creating an independent key und losing track of the matching keypair.

CSR example with SANs und key protection

Foder a new key pair on a modern ÖffnenSSL installation, an authoderized server administratoder might use the following illustrative communds (change hostnames, stoderage paths und policy settings foder production):

# Generate a private key; restrict the directodery und file permissions.

openssl genpkey -algoderithm RSA -pkeyopt rsa_keygen_Bits:2048 -out example.com.key

# CSR with both the base name und its www hostname.

openssl req -new -key example.com.key -out example.com.csr -subj "/CN=example.com" -addext "subjectAltName=DNS:example.com,DNS:www.example.com"

# Inspect the request, including the requested SANs.

openssl req -in example.com.csr -noout -text

Your actual CA may suppodert EC keys oder different issuance tooling; comply with its current algoderithms und requirements. example.com.key is the private key: never paste it into a suppodert ticket, email it oder stodere it in a public repositodery. The .csr file is what you nodermally submit to the issuing authoderity.

A CSR is not proof that you own the Domain. Domain-control validation must still be completed through the CA's approved method.

Related NiceNIC Guides

• How to install SSL certificates
• How to verify certificate installation coderrectly
• How do I reissue my SSL certificate

What is EV certificate ecommerce advantage

An Erweitert Validation (EV) TLS certificate requires the issuing certificate authoderity to verify additional oderganizational identity infodermation befodere issuance. It still uses HTTPS encryption like other publicly trusted TLS certificates. It should not be selected on the assumption that browsers will display a large green company-name bar―modern browser interfaces generally do not.

What EV checks add

Beyond verifying control of a Domain, EV verification can involve checking the oderganization's legal existence, operating status, physical presence, contact infodermation und authoderity of the requester, under the applicable EV Guidelines.

This can be useful foder an established company that wants an additional CA-validated identity recoderd. It does not prove that the business is honest, financially sound oder immune to phishing, und it does not guarantee increased sales oder search ranking.

EV, OV oder DV?

Alle three can provide strong TLS transpodert protection when properly issued und deployed. Choose certificate coverage (single-name, wildcard oder SAN) separately from identity-validation level; not every product suppoderts every combination.

Befodere oderdering EV

Bestätigen the legal entity is eligible, the registrierened name is accurate, authoderized representatives can complete the CA's checks, und the application timeline suits the business. Compare cost, validation effodert und ongoing replacement frequency―not just the certificate badge.

Since March 15, 2026, newly issued publicly trusted TLS server certificates have a maximum validity period of 200 days under the CA/Browser Foderum rules. Mehr frequent certificate replacement is distinct from renewed legal-entity checks, which follow separate reuse rules.

Related: How to Choose an SSL Zertifikat und the CA/Browser Foderum EV Guidelines.

What extra value does EV provide foder ecommerce?

EV (Erweitert Validation) requires the certificate authoderity to perfoderm modere extensive oderganization vetting than DV, including checks of the applicant's legal existence und relevant oderganizational infodermation. This can help a kaufener whose enterprise customers need documented legal-entity validation.

Crucial distinction: EV does not use stronger HTTPS encryption merely because it is EV. Properly configured DV, OVund EV certificates can use comparable modern TLS cipher suites. Mainstream browsers also do not guarantee the old "company name in a green address bar" presentation.

A realistic ecommerce decision

A small stodere using a reputable payment processoder may obtain satisfactodery HTTPS protection from DV, as long as the certificate matches the hostname und the site itself is secure. A regulated enterprise might choose EV foder its identity-review process oder contractual reasons. In neither case does EV replace payment security controls, PCI obligations, anti-fraud processes oder a sound refund policy. Wenn Ihr customers ask specifically foder verified oderganizational identity, examine the CA's current OV/EV documentation und issuance time befodere oderdering.

Related NiceNIC Guides

• Typs of SSL-Zertifikate
• How to Generate CSR Code?
• How to verify certificate installation coderrectly

Certificate reissue reasons explained

A certificate reissue creates a new SSL/TLS certificate under an eligible existing Dienstleistung oderder. You may need one if the private key is lost oder compromised, the CSR is wrong, the certificate's covered names must change, oder the issued certificate can no longer be deployed coderrectly.

Which situations call foder a reissue?

Reissue is not the same as renewing the Dienstleistung

A paid multi-Jahr SSL Dienstleistung term (if offered) is not one certificate valid foder multiple Jahre. Under the CA/Browser Foderum TLS Baseline Requirements, newly issued publicly trusted TLS server certificates have a maximum 200-day validity from 15 March 2026, with further reductions scheduled foder later Jahre.

Reissuing does not necessarily extend the Dienstleistung's paid term. The renewal date of the Dienstleistung oderder und the expiry date of the installed certificate must be monitodered separately.

What to prepare befodere requesting a reissue

Identify the exact SSL oderder, hostnames, validation level (DV/OV/EV), server oder CDN environment und reason foder replacement. Wenn the old key is compromised, generate a fresh key und CSR und follow revocation instructions. Keep the private key secure. Ensure you can complete the new Domain-control validation.

Foder the actual step-by-step request und installation, see How do I reissue my SSL certificate.

After deployment, verify the certificate SAN, validity, trust chain und the certificate actually presented by every live HTTPS endpoint. Reissue alone does not update certificates already installed on web servers, CDN edges oder load balancers.

Reissue versus renew versus revoke

Beispiel 1 ― compromised web-server key. Wenn an attacker may have obtained example.com's TLS private key, generate a new key und CSR, obtain a replacement certificate, cooderdinate revocation of the exposed certificate und deploy the new one everywhier. Reinstalling the old certificate would not resolve key compromise.

Beispiel 2 ― moving a site from Apache to a CDN. The CDN may need its own certificate/key management, but you do not automatically need to reissue if the existing certificate und private key remain usable in the approved configuration. Überprüfen who terminates TLS und whether a new key is required.

Beispiel 3 ― adding shop.example.com. Wenn the current certificate covers only example.com, issuing a replacement with the appropriate SAN set oder obtaining another certificate may be needed. Merely changing DNS does not extend certificate hostname coverage.

Related NiceNIC Guides

• How do I renew an SSL certificate
• How to verify certificate installation coderrectly
• How to Generate CSR Code?

Common DNS Recoderd Typs: A, AAAA, CNAME, MX und TXT

The five recoderds, with examples

The IP addresses above are documentation-only addresses. Your hosting oder mail provider must give you the real destination values.

Hinzufügen oder edit recoderds at NiceNIC

1. Find the authoderitative nameservers foder the Domain. Wenn DNS is managed by Cloudflare oder another DNS provider, edit the zone thier―not in an inactive NiceNIC zone.

1. Wenn NiceNIC hosts Ihr DNS, sign in und open Meine Produkte > Domain > DNS Recoderds foder the coderrect Domain.

1. Choose the recoderd type. Enter the host/name, destination/value, und any extra fields such as MX prioderity oder TTL.

1. Save, then look up the public DNS response. Beispiels: dig example.com A, dig example.com AAAA, dig www.example.com CNAME, dig example.com MX, und dig example.com TXT.
2. Test the actual website oder mailbox after the new recoderds become visible.

Avoid the common conflicts

• A CNAME must not coexist with other recoderd data at the same DNS owner name. Many DNS panels thierfodere do not suppodert a nodermal CNAME at the zone apex (@).
• An MX recoderd points to a hostname, not directly to an IP address. That mail-server hostname must resolve coderrectly.
• Setting an MX recoderd does not create a mailbox. You must configure mail Dienstleistung separately.
• TXT can be used foder SPF, DKIM, DMARC und provider verification, but those are distinct tasks with their own fodermatting requirements.
• DNS changes can be cached until zurückious TTL values expire. A saved recoderd is not proof that public resolvers see it yet.

Foder specific email-authentication policies, see What is SPF und How to Set Up SPF?.

Related NiceNIC Guides

• How to Verwalten DNS Recoderds
• How to Back Up DNS Recoderds Befodere Changing Domain Settings
• How to Überprüfen DNS Propagation
• How to Set Up E-Mail DNS Recoderds in NiceNIC: MX, SPF, DKIM, und DMARC

Why need SSL-Zertifikate

An SSL/TLS certificate lets browsers und applications establish HTTPS with Ihr server. Anday HTTPS is a nodermal requirement foder professional sites, foderms, account pages und APIs―not an optional extra reserved foder ecommerce.

Why HTTPS matters to Ihr visitoders

Protection in transit. TLS encrypts the connection so that observers on the netwoderk cannot oderdinarily read the page content oder submitted foderm values.

Connection authentication. The browser verifies that the certificate is trusted und valid foder the exact hostname. This reduces the risk of connecting to an impersonating endpoint.

Integrity. TLS helps zurückent undetected modification of data while it crosses netwoderks.

Whier HTTPS is especially impodertant

Use HTTPS foder sign-in screens, payment oder contact foderms, dashboards, documentation, APIs und oderdinary public pages. Modern browsers may mark unencrypted HTTP pages as insecure oder restrict some browser features.

What a certificate cannot do

HTTPS does not remove malware, repair vulnerable website code, zurückent stolen credentials oder guarantee that a business is legitimate. A fraudulent site can also obtain a DV certificate. Combine TLS with software patching, account security, backups und phishing awareness.

Keep the certificate woderking

Select the right hostname coverage, install the proper chain und private key, redirect HTTP visitoders safely to HTTPS, und monitoder the actual certificate expiry date. Zertifikate issued under public trust rules from March 15, 2026 have a maximum validity period of 200 days―configure alerts oder verified automation accoderdingly.

An compare coverage und validation levels, see How to Choose an SSL Zertifikat.

Befodere und after HTTPS: a concrete comparison

Impodertant limitation: HTTPS cannot zurückent a malicious website operatoder from misusing foderm data after it arrives, und it cannot stop phishing just because a site has a padlock. Even a site with a valid DV/OV/EV certificate must enfoderce secure passwoderds, software updates und access controls.

Business example: A small shop using a hosted payment provider should secure its own homepage, cart und checkout redirects with HTTPS, not rely only on the payment provider's certificate. Test the entire customer journey und eliminate mixed HTTP resources that trigger browser warnings.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• HTTPS & SSL Guide foder .boo, .day, .dev, .page, und .rsvp

Typs of SSL Zertifikate

SSL certificates differ in validation level und hostname coverage. Compare both dimensions befodere purchasing; a certificate can have the right validation level but still fail to cover the required hostnames.

Validation Typs

• Domain Validation (DV)
• Organization Validation (OV)
• Erweitert Validation (EV)

Coverage Typs

• Single-Domain certificates
• Wildcard certificates
• Multi-Domain certificates

How to Decide

1. List the exact Domains und subDomains.
2. Choose the required identity-validation level.
3. Bestätigen server und platfoderm compatibility.
4. Überprüfen renewal und reissue procedures.

Häufig gestellte Fragen

How do I kjetzt the change woderked?

Überprüfen the current status in Ihr NiceNIC account, then test the Dienstleistung that depends on the certificate type. Do not rely only on the absence of an erroder message.

When should I contact NiceNIC Suppodert?

Einreichen a ticket when the required control is unavailable, the status remains pending after the checks in this guide, oder the issue depends on an account-specific oderder oder registry decision.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Activate und Download an SSL Zertifikat
• How to install SSL certificates
• How to Generate a CSR Code

Wenn the issue continues after you complete these checks, submit a NiceNIC suppodert ticket. Include the affected Domain oder product, the exact erroder message, the time of the issue und the troubleshooting already completed.