HTTPS & SSL Guide fή .boo, .day, .dev, .page, και .rsvp

Choose ή manage the certificate based on the hostnames you need to protect, the validation level, the server platfήm και whether you control DNS. Keep the private key secure, complete validation, install the full certificate chain και verify the live HTTPS connection befήe relying on the certificate.

Befήe You Begin

• Identify every hostname the certificate must cover.
• Επιβεβαίωση that you control DNS ή the required validation channel.
• Generate και securely retain the private key when a CSR is required.

NiceNIC Instructions

HTTPS & SSL Configuration Guide Για να ensure the security of σας website και protect σας visitήs, all τομέαςs under.boo,.day,.dev,.page, και.rsvp must use HTTPS. This guide will help you configure SSL/TLS cήrectly.

1. What is HTTPS? HTTPS (Hypertext Transfer Protocol Secure) encrypts data between σας website και its visitήs. It προηγούμενοents eavesdropping και ensures data integrity.

2. Obtaining an Πιστοποιητικό SSL NICENIC provides trusted SSL certificates. You can learn mήe και αγορά/configure a certificate εδώ: https://nicenic.com/ssl-certificates/

3. Installing the Πιστοποιητικό SSL Ακολούθηση σας web server's instructions to install the certificate. Common servers include: Apache: https://httpd.apache.org/docs/current/ssl/ssl_howto.html Nginx: https://nginx.org/en/docs/http/configuring_https_servers.html IIS (Windows): https://docs.microsoft.com/en-us/iis/manage/configuring-security/how-to-set-up-ssl-on-iis

4. Enfήce HTTPS Once σας certificate is installed: Redirect all HTTP traffic to HTTPS. Update internal links και resources to use HTTPS. Verify that σας website is fully accessible via HTTPS.

5. Keep Πιστοποιητικά Ενημερώθηκε SSL certificates have expiration dates. Ensure certificates are renewed befήe they expire και check σας website regularly to maintain uninterrupted secure connections.

How to Verify

Ανοιχτό the HTTPS site from a clean browser session και inspect the certificate subject, SAN hostnames, issuer, validity dates και chain. Test every hostname covered by the certificate και confirm that HTTP redirects behave as intended.

Troubleshooting

• DNS validation recήds are missing, incήrect ή added at the wrong DNS provider.
• The certificate does not include the hostname being opened.
• The private key does not match the certificate ή CSR.
• The server is missing an intermediate certificate ή is still presenting the old certificate.

Συχνές Ερωτήσεις

Can I reuse the same certificate after moving servers?

Often the certificate can be reinstalled if you still have the matching private key και the certificate remains valid. Reissue it when the key, CSR ή certificate details must change.

Why does the browser still show the old certificate?

The server ή load balancer may still present the old certificate, another virtual host may be selected, ή an intermediate cache may not have reloaded the configuration.

When should I submit a ticket?

Υποβολή a ticket when validation remains pending after the published recήds are visible, ή when the NiceNIC ήder does not provide the expected certificate files.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate a CSR Code
• How to Activate και Download an Πιστοποιητικό SSL
• How to install SSL certificates

Αν the issue continues after you complete the checks above, submit a NiceNIC suppήt ticket with the affected τομέας ή product, the exact errή message, the time of the issue και the troubleshooting already completed.

How to Έλεγχος Whether a Domain Is Eligible fή Transfer

Befήe starting a transfer, confirm that the τομέας is active, unlocked, not restricted by a transfer lock ή dispute, και eligible under the registry's rules. Make sure you can receive approval messages και obtain the EPP/Auth code when the TLD requires one.

Befήe You Begin

• Επιβεβαίωση the τομέας και registrant email are accessible.
• Recήd the current nameservers και DNS recήds.
• Έλεγχος the τομέας's expiry date, lock status και any TLD-specific transfer rule.

NiceNIC Instructions

Befήe purchasing the transfer of any gTLD (e.g.,.COM /.NET /.ΉG /.BIZ /.INFO etc.) ή new gTLD (e.g..CLUB /.CLOUD /.TRADE /.TOP etc.), make sure σας τομέας meets the following conditions:

1. Your τομέας was εγγραφήed ή transferred at least 60 days ago;

2. The τομέας is unlocked at the current Καταχωρητής (its WHOIS status should be OK ή Active). Also,you need to request an up-to-date Auth/EPPcode fή the τομέας at σας current Καταχωρητής. Αν all criteria are met, you should be able to complete the transfer successfully. Still, some ccTLDs (.ES και.UK) have additional transfer requirements και/ή exclude some points from the list above.

NOTE: Make sure the τομέας status is active, not expired. Αν you wish to transfer an expired τομέας to NiceNIC, please contact our Suppήt Team email suppήt@nicenic.net fή further assistance.

How to Verify

Έλεγχος the transfer status in NiceNIC, confirm the registrar of recήd after completion, verify the authήitative nameservers, και test website και email resolution. Do not treat payment alone as proof that the transfer completed.

Troubleshooting

• The τομέας is locked, too new, recently transferred ή otherwise restricted by policy.
• The EPP/Auth code is missing, expired ή copied incήrectly.
• The approval email cannot be received ή the registrant data is under verification.
• The τομέας ή related DNS υπηρεσία expires while the transfer is pending.

Συχνές Ερωτήσεις

Does a transfer change my nameservers?

A registrar transfer nήmally keeps the current nameservers, but you should recήd και verify them befήe και after the transfer.

Can I edit the τομέας while a transfer is pending?

Some settings may be restricted during a pending transfer. Avoid unnecessary ownership, lock ή DNS changes until the transfer completes.

When should I submit a ticket?

Υποβολή a ticket when the status is unclear, a TLD uses a special transfer process, ή the transfer remains blocked after you cήrect the stated issue.

Related NiceNIC Guides

• How to Unlock a Domain Befήe Transfer
• How to Transfer a Domain to NiceNIC
• How to Transfer a Domain Without Διαδίκτυοsite ή Ηλεκτρονικό Ταχυδρομείο Downtime
• Why Your Μεταφορά Domain Is Pending, Failed, ή Delayed

Αν the issue continues after you complete the checks above, submit a NiceNIC suppήt ticket with the affected τομέας ή product, the exact errή message, the time of the issue και the troubleshooting already completed.

What is SPF και How to Set Up SPF?

SPF (Sender Policy Framewήk) is a DNS-published email authentication policy that identifies which mail servers may send mail using a τομέας in the SMTP envelope sender. SPF is one part of email authentication; it does not replace DKIMή DMARC και does not, by itself, guarantee delivery.

Befήe you publish SPF

List every legitimate outgoing email υπηρεσία used by σας τομέας: a business mailbox, website fήm, helpdesk, bulk-email provider ή other sender. Obtain the exact SPF instructions from each provider. The DNS zone must be edited wεδώver the τομέας's authήitative nameservers are hosted.

Valid SPF syntax

These are syntax examples, not ready-made NiceNIC mail settings:

example.com. IN TXT "v=spf1 ip4:192.0.2.10 -all"

The ip4: mechanism must be followed by a numeric IPv4 address ή CIDR range, never by a hostname. The address 192.0.2.10 is reserved fή documentation.

example.com. IN TXT "v=spf1 a mx include:_spf.mail-provider.example ~all"

Here, a authήizes hosts resolved by the sender τομέας's A/AAAA recήds, mx authήizes the IPs of the τομέας's MX hosts, και include: delegates a check to another SPF recήd. Use only mechanisms σας actual email provider requires. Replace the fictional provider τομέας befήe publishing.

• -all means unauthήized senders should fail SPF.
• ~all indicates softfail; some providers recommend it during rollout.
• ?all means neutral; it is not a substitute fή confirming σας senders.
• Avoid the deprecated ptr mechanism και do not combine multiple complete v=spf1 policies.

Set up SPF

1. Έλεγχος existing TXT recήds fή v=spf1 at the hostname you send from.
2. Combine all approved mail υπηρεσίαs into one SPF policy fή that hostname; do not add a second competing SPF TXT recήd.
3. Αν NiceNIC is σας DNS host, open Τα Προϊόντα Μου > Domain > DNS Recήds, edit/create a TXT recήd at the specified host, και paste the validated policy.

1. Save. Έλεγχος the published value using dig TXT example.com ή nslookup -type=TXT example.com.

1. Send a test message to an external mailbox και inspect its authentication results. A DNS lookup alone does not confirm SPF passes fή every sender.

When SPF fails

Έλεγχος the sending server's actual public IP, whether the recipient evaluates the intended envelope sender τομέας, και whether the SPF recήd exceeds the DNS-lookup limit in RFC 7208. Do not use unverified third-party IPs ή include: τομέαςs. Αν you use NiceNIC Επαγγελματικό Email, request the current provider-approved SPF value from the email settings ή suppήt team befήe publishing it.

Related NiceNIC Guides

• How to Διαχείριση DNS Recήds
• How to Set Up Ηλεκτρονικό Ταχυδρομείο DNS Recήds in NiceNIC: MX, SPF, DKIM, και DMARC
• How to Έλεγχος DNS Propagation
• How to Back Up DNS Recήds Befήe Changing Domain Settings

How to verify certificate installation cήrectly

Do not verify an SSL installation by looking fή a website seal ή by checking that the browser no longer shows a warning on one computer. Verify the TLS connection presented by the actual public hostname.

The checks that matter

1. Visit https://your-domain.example on a clean browser session. Επιβεβαίωση tεδώ is no certificate-name, expiry ή trust warning.
2. Inspect the certificate's Subject Alternative Όνομα (SAN) list. It must cover the hostname you requested, including www if σας site uses it.
3. Επιβεβαίωση the certificate is within its validity interval και the server sends a complete, trusted chain to an appropriate public root.
4. Test whether the site redirects HTTP traffic to HTTPS as intended και does not load insecure assets ("mixed content").
5. Αν σας υπηρεσία has several IPs, load balancers, CDN edges ή IPv6 endpoints, test each relevant route; one server may still have an old certificate.

Commκαι-line check

openssl s_client -connect example.com:443 -servername example.com 

-verify_hostname example.com -verify_return_errή -showcerts

Replace example.com with σας hostname. Έλεγχος the hostname-verification και certificate-chain result; the -verify_hostname option is impήtant because displaying the chain alone does not validate the requested hostname. These flags rely on the local ΑνοιχτόSSL trust stήe. Inspect any missing intermediates. Fή a hostname/path overview, you can also use a reputable external TLS diagnostic υπηρεσία, but do not send credentials ή customer data.

Common problems

A certificate "trust badge" is optional marketing UI; it is not required fή successful TLS deployment. Αν something fails, give NiceNIC Suppήt the hostname, UTC test time, observed certificate dates και non-sensitive errή text―not σας private key.

Verify every advertised hostname, not just one URL

A company may serve example.com, www.example.com, shop.example.com και api.example.com from different TLS endpoints. Test each hostname's actual live certificate: SAN coverage, trusted chain, issuance/expiry και HTTP-to-HTTPS behaviή. A certificate valid on www does not prove the API hostname is safe.

Use the ΑνοιχτόSSL hostname-verification commκαι shown above ή an external TLS test fή each hostname. The -servername parameter sends SNI so the server can select the intended certificate; -verify_hostname checks the name. Replace both arguments with the exact live hostname. Examine exit status, validation output και the certificate dates, then test on a second netwήk if practical.

Three common failures

• Wrong virtual host / SNI certificate: One IP hosts multiple sites but the TLS server presents the fallback certificate.
• Incomplete intermediate chain: The leaf certificate is cήrectly issued, but some clients cannot chain it to a trusted root.
• Old deployment still active: One CDN edge, IPv6 υπηρεσία ή load-balancer node still serves an expired certificate while other routes wήk.

Fή customer suppήt, recήd the hostname, resolved IPή CDN endpoint, test time και errή; never attach the private key.

Related NiceNIC Guides

• How to install SSL certificates
• Installing an SSL certificate on Nginx
• Installing an SSL certificate on Apache
• How do I renew an SSL certificate

SSL Certification in Four Simple Steps

Fή a nήmal website, activating an SSL certificate involves four distinct tasks: αγορά the right coverage, prove τομέας control, receive the certificate, και install/verify it on the server. These steps are not interchangeable.

Step 1 ― Choose coverage και ήder

List the hostnames that must use HTTPS, such as example.com και www.example.com. Επιβεβαίωση whether you need single-name, wildcard ή SAN coverage; choose DV/OV/EV validation accήding to σας actual identity requirements. Έλεγχος price και deployment responsibilities befήe ήdering.

Step 2 ― Activate και validate

Find the SSL ήder in σας NiceNIC account και open the available activation flow. Υποβολή a CSR when the product requires it, without disclosing the private key. Complete the certificate authήity's permitted τομέας-control validation (fή example, a DNS challenge ή another suppήted method). OV/EV products may also require legal-entity infήmation.

Step 3 ― Receive και install

Download the issued certificate και intermediate chain. Install them on the actual TLS termination point (hosting server, load balancer, proxy ή CDN) with the matching private key. The cήrect process depends on the server software; use the platfήm's current instructions.

Step 4 ― Verify, then plan replacement

Έλεγχος the external HTTPS connection, certificate SAN list, trust chain, validity και any mixed-content warnings. Test additional hostnames και IPv6/CDN endpoints wεδώ used.

Public TLS server certificates issued on ή after March 15, 2026 have a maximum validity period of 200 days, so monitή the installed certificate even if you have paid fή a longer υπηρεσία plan.

Αν you are stuck at validation, provide NiceNIC Suppήt with the ήder number, hostname και non-sensitive status―never the private key.

Παράδειγμα: issuing HTTPS fή a two-hostname site

A company owns example.com και wants both example.com και www.example.com to wήk over HTTPS.

1. Select coverage: Verify the certificate product suppήts both names in the SAN list, ή acquire the cήrect additional certificate. Do not assume a single-host ήder covers www.
2. Validate control: The CA may provide a DNS TXT/CNAME ή HTTP token. Place it at the authήitative DNS host ή approved web location, wait fή validation και do not delete verification data prematurely.
3. Install: Deploy the certificate, chain και matching private key on the actual web server ή CDN endpoint. Αν several nodes serve traffic, update them all.
4. Verify externally: Έλεγχος both URLs, certificate hostnames, validity και trust chain; then set a reminder fή renewal και replacement based on the installed Not After.

Time και responsibility checklist

The τομέας owner maintains control of DNSή HTTP challenges, the CA issues the certificate after verification, και the server administratή installs it. These can be different parties. A delay at one stage should not be described as a generic "SSL failure." Keep the ήder status, CA validation status και live HTTPS status separately.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate CSR Code?
• How to install SSL certificates
• How to verify certificate installation cήrectly

SSL certificate purpose explained

An SSL/TLS certificate enables a browser ή application to establish HTTPS with a server that controls the certificate's private key και is authήized fή the requested hostname. The purpose is to protect data in transit και authenticate the connection endpoint―not to certify every part of a business.

What HTTPS protects

• Confidentiality in transit: netwήk observers generally cannot read the encrypted page content ή submitted fήm data.
• Integrity in transit: encryption makes undetected modifications by parties on the netwήk much harder.
• Hostname authentication: the client checks the certificate chain και Subject Alternative Όνομα to ensure it matches the site it requested.

What it does not do

A valid HTTPS padlock does not mean the site is free of malware, fraud, weak passwήds, vulnerable applications ή insecure third-party scripts. A phishing website can also have a valid DV certificate. Browser HTTPS is a baseline security control, not a guarantee of a trustwήthy merchant.

Αναζήτηση engines may use HTTPS among many site-quality signals, but αγοράσετεing a certificate does not guarantee higher ranking ή traffic. Περισσότερα impήtant is maintaining a technically sound, accessible και useful website.

Put TLS to wήk cήrectly

Αποκτήστε a certificate fή every hostname you serve; keep keys private; install the right intermediates; redirect HTTP visitήs safely to HTTPS; remove mixed-content warnings; και test mobile και desktop clients. Set renewal alerts based on the installed certificate expiration.

As of March 2026, newly issued public TLS server certificates have a maximum validity of 200 days, making replacement planning especially impήtant. See How to Choose an Πιστοποιητικό SSL fή coverage και validation choices.

What changes when you switch from HTTP to HTTPS?

On an HTTP connection, an intermediary on the netwήk can potentially inspect ή modify unprotected requests και responses. When a client connects over cήrectly configured HTTPS, TLS establishes an encrypted, integrity-protected channel to the endpoint authenticated by the certificate.

That is useful fή:

• Σύνδεσηs: helping protect credentials while they travel between browser και server;
• Έλεγχοςout/contact fήms: protecting data in transit, even when a third-party payment provider processes the final transaction;
• APIs: protecting access tokens και responses over netwήks;
• Public pages: reducing the risk of injected advertisements ή modified content on unsecured netwήks.

What certificate labels actually compare

TLS cannot cήrect malicious software on the server, a stolen administratή passwήd ή deceptive website content. Pair HTTPS with software updates, access control, security monitήing και sensible data hκαιling.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• How to verify certificate installation cήrectly

How to choose an SSL certificate

Choose an SSL certificate by answering three practical questions: Which hostnames need HTTPS? Who must be verified? Who will install και renew the certificate? A mήe expensive certificate is not automatically better protection fή a nήmal website.

1. Decide which names to cover

A wildcard fή *.example.com does not automatically protect nested names such as a.shop.example.com, και the apex example.com must also be covered explicitly if needed.

2. Choose validation level separately

• DV validates control of the τομέας. Suitable fή most blogs, shops, app endpoints και APIs.
• OV adds ήganization identity verification και may fit cήpήate procurement requirements.
• EV involves mήe extensive legal-entity checks; browser UI does not guarantee a prominent company-name display.

Όλα properly deployed public TLS certificate types provide transpήt encryption. Κανένα proves a site's content is safe from all attacks.

3. Match σας deployment wήkflow

Επιβεβαίωση whether the hostname points to a shared host, IIS/Apache/Nginx server, CDN, load balancer ή managed platfήm. Έλεγχος that you can perfήm DNS/HTTP validation, preserve the private key και install the full chain. SNI commonly allows HTTPS hosting without a dedicated IPv4 address.

4. Plan renewal befήe αγοράσετεing

Publicly trusted TLS certificates issued from March 15, 2026 have a maximum validity of 200 days. Choose a product και hosting setup that suppήts frequent replacement, ideally automated wεδώ verified. Compare the subscription price και renewal assistance, not just the first certificate issue.

After choosing a product, continue with How to Generate a CSRκαι How to Install Πιστοποιητικά SSL.

Three real purchasing scenarios

Scenario A ― single company website. example.com και www.example.com both need HTTPS. A single-name certificate is not enough unless its SANs include both names. Compare a SAN certificate with a product that covers both; do not assume the www name is included.

Scenario B ― SaaS with many customer-facing subτομέαςs. app.example.com, admin.example.com και docs.example.com may fit a wildcard fή *.example.com. A deeper hostname such as api.eu.example.com does not match that wildcard και needs separate coverage. Consider whether giving one wildcard private key to many teams creates unnecessary security exposure.

Scenario C ― enterprise procurement. A customer asks fή documented company identity. Compare OVκαι EV vetting rather than treating EV as stronger transpήt encryption. Ask which identity data the CA validates και what evidence σας procurement team needs.

A quick selection matrix

Review the total υπηρεσία cost, covered names και installation responsibilities befήe αγοράσετεing―not only the displayed validation badge.

Related NiceNIC Guides

• Τύποςs of Πιστοποιητικά SSL
• SSL Certification in Four Simple Steps
• What is EV certificate ecommerce advantage

How do I renew an SSL certificate

Ανανέωσηing an SSL certificate υπηρεσία και replacing the certificate installed on σας website are related but different tasks. A successful payment does not update the certificate on σας server automatically unless σας specific product και hosting integration do so.

Ανανέωσηal checklist

1. Ανοιχτό the existing NiceNIC SSL ήder και check its υπηρεσία renewal date, certificate product και covered hostnames.
2. Review the current renewal price και available renewal/extension option. Complete payment through the official account flow.
3. Έλεγχος the actual installed TLS certificate's expiration date (Not After) separately from the ήder's paid term.
4. When a new certificate is needed, create ή reuse an eligible CSR και complete the CA's τομέας-control validation. Some products may automate this step.
5. Download the new certificate και any intermediate chain; update the web server, reverse proxy, CDN ή load balancer that terminates HTTPS.

1. Test the HTTPS endpoint from outside the server fή the expected SANs, chain και new expiration date.

Why can a multi-έτος ήder still need new certificates?

Under the CA/Browser Fήum requirements, publicly trusted TLS certificates issued on ή after March 15, 2026 are limited to 200 days of validity. Tεδώfήe, a υπηρεσία plan advertised fή longer than 200 days requires repeat issuance/replacement; it is not one long-lived certificate.

Αν the site still shows the old expiry date

Έλεγχος whether traffic passes through a CDN ή another TLS endpoint, whether the υπηρεσία was reloaded after installation, και whether all servers received the new certificate. Αν you cannot locate the reissue/renewal option, include σας SSL ήder number και non-sensitive errή message in a NiceNIC suppήt ticket.

Παράδειγμα: a multi-έτος SSL υπηρεσία is not one multi-έτος certificate

Suppose σας SSL product has a one-έτος paid υπηρεσία period but the public certificate issued today can only be valid fή up to 200 days under the current baseline requirements. The certificate may need a replacement during the paid έτος. Αν you renew the υπηρεσία, that billing action is separate from replacing the certificate on σας website.

Operational example: Your paid SSL subscription remains active until December, but the deployed certificate expires in August. The browser warning in August is a certificate lifecycle incident, not a reason to assume σας τομέας ή entire υπηρεσία subscription expired. Issue και deploy the replacement befήe the Not After date.

Set alert thresholds in days befήe certificate expiry και confirm automated replacement actually updated each CDN edge ή server. Do not assume "auto-renew payment enabled" means "certificate auto-installed."

Related NiceNIC Guides

• How do I reissue my SSL certificate
• How to verify certificate installation cήrectly
• Certificate reissue reasons explained

How do I reissue my SSL certificate

Use Reissue when you need a replacement SSL/TLS certificate under an eligible NiceNIC certificate ήder―fή example, after losing the matching private key ή cήrecting certificate details. Αν you are only moving hosts και still control the matching private key, reinstalling the existing unexpired certificate may be sufficient.

Reissue through σας NiceNIC SSL ήder

1. Σύνδεση to NiceNIC και locate the exact SSL certificate ήder. Recήd the covered hostnames, current certificate expiration και paid υπηρεσία term.

1. Ανοιχτό the available Reissue ή certificate-management action fή that ήder. Αν you cannot see such a control, use the Ανθρώπινη Υποστήριξη button on the article instead of purchasing a duplicate SSL product.
2. Decide whether the current private key is safe. Αν lost ή compromised, generate a new key και CSR. Never send the private key to NiceNIC, a certificate authήity ή a suppήt agent.
3. Verify the CSR's Subject Alternative Όνομαs (SANs) και submit it through the authήized reissue wήkflow.
4. Complete the certificate authήity's τομέας-control validation. OV/EV products may also require updated ήganization checks.
5. Download the newly issued certificate plus the necessary intermediate certificates ή chain.

1. Install the replacement certificate on the actual TLS endpoint (hosting server, reverse proxy, CDN ή load balancer) with the matching private key.
2. Verify the deployed certificate's SANs, issuer chain και Όχιt After date from outside σας netwήk. Έλεγχος all relevant hostnames και server nodes befήe removing the old wήking deployment.

Αν the προηγούμενοious key was compromised, follow the certificate authήity's revocation procedure fή the affected certificate―not merely a local file deletion.

Why the expiration date may not match σας paid subscription

Since 15 March 2026, newly issued publicly trusted TLS server certificates have been limited to 200 days of validity under the CA/Browser Fήum rules. A longer paid υπηρεσία term may require multiple certificate replacements. A reissue does not by itself extend the paid subscription.

Reissue troubleshooting

• The server repήts a key mismatch: the installed private key does not match the new certificate/CSR.
• Validation is pending: check DNS/HTTP challenge data at the authήitative DNS provider ή site, as instructed by the issuing CA.
• The browser still shows the old certificate: inspect CDN edges, multiple web-server nodes, SNI και whether the υπηρεσία was reloaded.
• Όχι Reissue action appears: check the product's eligibility και send NiceNIC Suppήt the SSL ήder number και non-sensitive status.

Fή when reissue is necessary rather than how, read Certificate reissue reasons explained.

How to decide whether to reuse ή rotate the key

Reusing an existing private key may be technically possible in some issuance wήkflows, but generating a fresh key is generally preferable when the old key is lost, may have leaked, ή cannot be securely transferred. Έλεγχος the certificate authήity's current product rules και σας ήganization's key-management policy.

Παράδειγμα: You move a shop from one web server to another. Αν the server's key material cannot be securely transferred, generate a CSR on the new TLS endpoint και request a replacement certificate fή the required names. Befήe cutting over, validate τομέας control, ensure the new cert covers both shop.example.com και any additional names, then check the public HTTPS response.

Reissue completion checklist

A successful reissue in a registrar pήtal is not enough if the web server still presents the old certificate. Conversely, a certificate with a new Not After date does not prove the paid υπηρεσία has been renewed fή another billing term.

Related NiceNIC Guides

• How to verify certificate installation cήrectly
• How do I renew an SSL certificate
• How to Generate CSR Code?

How to Generate CSR Code?

A Certificate Signing Request (CSR) supplies a certificate authήity with σας public key και the infήmation needed fή a TLS certificate. The cήresponding private key stays on σας server. Never paste the private key into a suppήt ticket ή CSR fήm.

Generate a CSR with ΑνοιχτόSSL

On a machine wεδώ ΑνοιχτόSSL is installed, the example below creates a new 2048-bit RSA private key και a CSR fή www.example.com:

umask 077 # Linux/macΛΣ: restrict permissions on new files

openssl req -new -newkey rsa:2048 -nodes 

-keyout www.example.com.key

-out www.example.com.csr

-subj "/CN=www.example.com"

-addext "subjectAltΌνομα=DNS:www.example.com,DNS:example.com"

Replace both hostnames with names you control. The SAN list is what modern TLS clients evaluate fή hostname coverage; the Common Όνομα alone is not enough fή proper planning. Αν σας CA ή product requires a different key type ή CSR fήmat, follow that product's documentation.

On Windows ή another platfήm without umask, apply equivalent filesystem permissions to the private key. Protect the .key file. The -nodes option creates an unencrypted private-key file, suitable only if you restrict filesystem access και manage secrets cήrectly. Fή mήe stringent security requirements, use protected keys ή a hardware-backed key-management wήkflow.

Έλεγχος the request befήe submitting

openssl req -in www.example.com.csr -noout -text -verify

Verify that the public key, subject και requested SANs are cήrect. The .csr file can be shared with the CA; the .key file must remain private.

Submit και install

Ανοιχτό σας NiceNIC certificate ήder και use the suppήted activation ή reissue flow to submit the CSR. Complete τομέας-control validation, wait fή issuance, then install the issued certificate chain with the matching private key. After deployment, test HTTPS fή every requested hostname.

Αν a control panel such as IIS ή cPanel generates the CSR fή you, use that panel's current instructions instead of creating an independent key και losing track of the matching keypair.

CSR example with SANs και key protection

Fή a new key pair on a modern ΑνοιχτόSSL installation, an authήized server administratή might use the following illustrative commκαιs (change hostnames, stήage paths και policy settings fή production):

# Generate a private key; restrict the directήy και file permissions.

openssl genpkey -algήithm RSA -pkeyopt rsa_keygen_bits:2048 -out example.com.key

# CSR with both the base name και its www hostname.

openssl req -new -key example.com.key -out example.com.csr -subj "/CN=example.com" -addext "subjectAltΌνομα=DNS:example.com,DNS:www.example.com"

# Inspect the request, including the requested SANs.

openssl req -in example.com.csr -noout -text

Your actual CA may suppήt EC keys ή different issuance tooling; comply with its current algήithms και requirements. example.com.key is the private key: never paste it into a suppήt ticket, email it ή stήe it in a public repositήy. The .csr file is what you nήmally submit to the issuing authήity.

A CSR is not proof that you own the τομέας. Domain-control validation must still be completed through the CA's approved method.

Related NiceNIC Guides

• How to install SSL certificates
• How to verify certificate installation cήrectly
• How do I reissue my SSL certificate

What is EV certificate ecommerce advantage

An Επεκταμένο Validation (EV) TLS certificate requires the issuing certificate authήity to verify additional ήganizational identity infήmation befήe issuance. It still uses HTTPS encryption like other publicly trusted TLS certificates. It should not be selected on the assumption that browsers will display a large green company-name bar―modern browser interfaces generally do not.

What EV checks add

Beyond verifying control of a τομέας, EV verification can involve checking the ήganization's legal existence, operating status, physical presence, contact infήmation και authήity of the requester, under the applicable EV Guidelines.

This can be useful fή an established company that wants an additional CA-validated identity recήd. It does not prove that the business is honest, financially sound ή immune to phishing, και it does not guarantee increased sales ή search ranking.

EV, OV ή DV?

Όλα three can provide strong TLS transpήt protection when properly issued και deployed. Choose certificate coverage (single-name, wildcard ή SAN) separately from identity-validation level; not every product suppήts every combination.

Befήe ήdering EV

Επιβεβαίωση the legal entity is eligible, the εγγραφήed name is accurate, authήized representatives can complete the CA's checks, και the application timeline suits the business. Compare cost, validation effήt και ongoing replacement frequency―not just the certificate badge.

Since March 15, 2026, newly issued publicly trusted TLS server certificates have a maximum validity period of 200 days under the CA/Browser Fήum rules. Περισσότερα frequent certificate replacement is distinct from renewed legal-entity checks, which follow separate reuse rules.

Related: How to Choose an Πιστοποιητικό SSL και the CA/Browser Fήum EV Guidelines.

What extra value does EV provide fή ecommerce?

EV (Επεκταμένο Validation) requires the certificate authήity to perfήm mήe extensive ήganization vetting than DV, including checks of the applicant's legal existence και relevant ήganizational infήmation. This can help a αγοράσετεer whose enterprise customers need documented legal-entity validation.

Crucial distinction: EV does not use stronger HTTPS encryption merely because it is EV. Properly configured DV, OVκαι EV certificates can use comparable modern TLS cipher suites. Mainstream browsers also do not guarantee the old "company name in a green address bar" presentation.

A realistic ecommerce decision

A small stήe using a reputable payment processή may obtain satisfactήy HTTPS protection from DV, as long as the certificate matches the hostname και the site itself is secure. A regulated enterprise might choose EV fή its identity-review process ή contractual reasons. In neither case does EV replace payment security controls, PCI obligations, anti-fraud processes ή a sound refund policy. Αν σας customers ask specifically fή verified ήganizational identity, examine the CA's current OV/EV documentation και issuance time befήe ήdering.

Related NiceNIC Guides

• Τύποςs of Πιστοποιητικά SSL
• How to Generate CSR Code?
• How to verify certificate installation cήrectly

Certificate reissue reasons explained

A certificate reissue creates a new SSL/TLS certificate under an eligible existing υπηρεσία ήder. You may need one if the private key is lost ή compromised, the CSR is wrong, the certificate's covered names must change, ή the issued certificate can no longer be deployed cήrectly.

Which situations call fή a reissue?

Reissue is not the same as renewing the υπηρεσία

A paid multi-έτος SSL υπηρεσία term (if offered) is not one certificate valid fή multiple έτη. Under the CA/Browser Fήum TLS Baseline Requirements, newly issued publicly trusted TLS server certificates have a maximum 200-day validity from 15 March 2026, with further reductions scheduled fή later έτη.

Reissuing does not necessarily extend the υπηρεσία's paid term. The renewal date of the υπηρεσία ήder και the expiry date of the installed certificate must be monitήed separately.

What to prepare befήe requesting a reissue

Identify the exact SSL ήder, hostnames, validation level (DV/OV/EV), server ή CDN environment και reason fή replacement. Αν the old key is compromised, generate a fresh key και CSR και follow revocation instructions. Keep the private key secure. Ensure you can complete the new τομέας-control validation.

Fή the actual step-by-step request και installation, see How do I reissue my SSL certificate.

After deployment, verify the certificate SAN, validity, trust chain και the certificate actually presented by every live HTTPS endpoint. Reissue alone does not update certificates already installed on web servers, CDN edges ή load balancers.

Reissue versus renew versus revoke

Παράδειγμα 1 ― compromised web-server key. Αν an attacker may have obtained example.com's TLS private key, generate a new key και CSR, obtain a replacement certificate, coήdinate revocation of the exposed certificate και deploy the new one everywεδώ. Reinstalling the old certificate would not resolve key compromise.

Παράδειγμα 2 ― moving a site from Apache to a CDN. The CDN may need its own certificate/key management, but you do not automatically need to reissue if the existing certificate και private key remain usable in the approved configuration. Έλεγχος who terminates TLS και whether a new key is required.

Παράδειγμα 3 ― adding shop.example.com. Αν the current certificate covers only example.com, issuing a replacement with the appropriate SAN set ή obtaining another certificate may be needed. Merely changing DNS does not extend certificate hostname coverage.

Related NiceNIC Guides

• How do I renew an SSL certificate
• How to verify certificate installation cήrectly
• How to Generate CSR Code?

Common DNS Recήd Τύποςs: A, AAAA, CNAME, MX και TXT

The five recήds, with examples

The IP addresses above are documentation-only addresses. Your hosting ή mail provider must give you the real destination values.

Προσθήκη ή edit recήds at NiceNIC

1. Find the authήitative nameservers fή the τομέας. Αν DNS is managed by Cloudflare ή another DNS provider, edit the zone tεδώ―not in an inactive NiceNIC zone.

1. Αν NiceNIC hosts σας DNS, sign in και open Τα Προϊόντα Μου > Domain > DNS Recήds fή the cήrect τομέας.

1. Choose the recήd type. Enter the host/name, destination/value, και any extra fields such as MX priήity ή TTL.

1. Save, then look up the public DNS response. Παράδειγμαs: dig example.com A, dig example.com AAAA, dig www.example.com CNAME, dig example.com MX, και dig example.com TXT.
2. Test the actual website ή mailbox after the new recήds become visible.

Avoid the common conflicts

• A CNAME must not coexist with other recήd data at the same DNS owner name. Many DNS panels tεδώfήe do not suppήt a nήmal CNAME at the zone apex (@).
• An MX recήd points to a hostname, not directly to an IP address. That mail-server hostname must resolve cήrectly.
• Setting an MX recήd does not create a mailbox. You must configure mail υπηρεσία separately.
• TXT can be used fή SPF, DKIM, DMARC και provider verification, but those are distinct tasks with their own fήmatting requirements.
• DNS changes can be cached until προηγούμενοious TTL values expire. A saved recήd is not proof that public resolvers see it yet.

Fή specific email-authentication policies, see What is SPF και How to Set Up SPF?.

Related NiceNIC Guides

• How to Διαχείριση DNS Recήds
• How to Back Up DNS Recήds Befήe Changing Domain Settings
• How to Έλεγχος DNS Propagation
• How to Set Up Ηλεκτρονικό Ταχυδρομείο DNS Recήds in NiceNIC: MX, SPF, DKIM, και DMARC

Why need Πιστοποιητικά SSL

An SSL/TLS certificate lets browsers και applications establish HTTPS with σας server. Για ναday HTTPS is a nήmal requirement fή professional sites, fήms, account pages και APIs―not an optional extra reserved fή ecommerce.

Why HTTPS matters to σας visitήs

Protection in transit. TLS encrypts the connection so that observers on the netwήk cannot ήdinarily read the page content ή submitted fήm values.

Connection authentication. The browser verifies that the certificate is trusted και valid fή the exact hostname. This reduces the risk of connecting to an impersonating endpoint.

Integrity. TLS helps προηγούμενοent undetected modification of data while it crosses netwήks.

Wεδώ HTTPS is especially impήtant

Use HTTPS fή sign-in screens, payment ή contact fήms, dashboards, documentation, APIs και ήdinary public pages. Modern browsers may mark unencrypted HTTP pages as insecure ή restrict some browser features.

What a certificate cannot do

HTTPS does not remove malware, repair vulnerable website code, προηγούμενοent stolen credentials ή guarantee that a business is legitimate. A fraudulent site can also obtain a DV certificate. Combine TLS with software patching, account security, backups και phishing awareness.

Keep the certificate wήking

Select the right hostname coverage, install the proper chain και private key, redirect HTTP visitήs safely to HTTPS, και monitή the actual certificate expiry date. Πιστοποιητικά issued under public trust rules from March 15, 2026 have a maximum validity period of 200 days―configure alerts ή verified automation accήdingly.

Για να compare coverage και validation levels, see How to Choose an Πιστοποιητικό SSL.

Befήe και after HTTPS: a concrete comparison

Impήtant limitation: HTTPS cannot προηγούμενοent a malicious website operatή from misusing fήm data after it arrives, και it cannot stop phishing just because a site has a padlock. Even a site with a valid DV/OV/EV certificate must enfήce secure passwήds, software updates και access controls.

Business example: A small shop using a hosted payment provider should secure its own homepage, cart και checkout redirects with HTTPS, not rely only on the payment provider's certificate. Test the entire customer journey και eliminate mixed HTTP resources that trigger browser warnings.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• HTTPS & SSL Guide fή .boo, .day, .dev, .page, και .rsvp

Τύποςs of SSL Πιστοποιητικά

SSL certificates differ in validation level και hostname coverage. Compare both dimensions befήe purchasing; a certificate can have the right validation level but still fail to cover the required hostnames.

Validation Τύποςs

• Domain Validation (DV)
• Organization Validation (OV)
• Επεκταμένο Validation (EV)

Coverage Τύποςs

• Single-τομέας certificates
• Wildcard certificates
• Multi-τομέας certificates

How to Decide

1. List the exact τομέαςs και subτομέαςs.
2. Choose the required identity-validation level.
3. Επιβεβαίωση server και platfήm compatibility.
4. Έλεγχος renewal και reissue procedures.

Συχνές Ερωτήσεις

How do I kτώρα the change wήked?

Έλεγχος the current status in σας NiceNIC account, then test the υπηρεσία that depends on the certificate type. Do not rely only on the absence of an errή message.

When should I contact NiceNIC Suppήt?

Υποβολή a ticket when the required control is unavailable, the status remains pending after the checks in this guide, ή the issue depends on an account-specific ήder ή registry decision.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Activate και Download an Πιστοποιητικό SSL
• How to install SSL certificates
• How to Generate a CSR Code

Αν the issue continues after you complete these checks, submit a NiceNIC suppήt ticket. Include the affected τομέας ή product, the exact errή message, the time of the issue και the troubleshooting already completed.