How do I renew an SSL certificate

Renewing an SSL certificate service and replacing the certificate installed on your website are related but different tasks. A successful payment does not update the certificate on your server automatically unless your specific product and hosting integration do so.

Renewal checklist

Open the existing NiceNIC SSL order and check its service renewal date, certificate product and covered hostnames.
Review the current renewal price and available renewal/extension option. Complete payment through the official account flow.
Check the actual installed TLS certificate's expiration date (Not After) separately from the order's paid term.
When a new certificate is needed, create or reuse an eligible CSR and complete the CA's domain-control validation. Some products may automate this step.
Download the new certificate and any intermediate chain; update the web server, reverse proxy, CDN or load balancer that terminates HTTPS.
Test the HTTPS endpoint from outside the server for the expected SANs, chain and new expiration date.

Why can a multi-year order still need new certificates?

Under the CA/Browser Forum requirements, publicly trusted TLS certificates issued on or after March 15, 2026 are limited to 200 days of validity. Therefore, a service plan advertised for longer than 200 days requires repeat issuance/replacement; it is not one long-lived certificate.

If the site still shows the old expiry date

Check whether traffic passes through a CDN or another TLS endpoint, whether the service was reloaded after installation, and whether all servers received the new certificate. If you cannot locate the reissue/renewal option, include your SSL order number and non-sensitive error message in a NiceNIC support ticket.

Example: a multi-year SSL service is not one multi-year certificate

Suppose your SSL product has a one-year paid service period but the public certificate issued today can only be valid for up to 200 days under the current baseline requirements. The certificate may need a replacement during the paid year. If you renew the service, that billing action is separate from replacing the certificate on your website.

Service/subscription expiry

Whether the provider continues to supply the paid SSL product

NiceNIC SSL order or subscription record

Certificate Not After

Whether browsers accept this particular deployed certificate after the date

Browser certificate viewer or OpenSSL

Domain registration expiry

Whether the underlying domain remains registered and usable

NiceNIC domain account / registry record

Operational example: Your paid SSL subscription remains active until December, but the deployed certificate expires in August. The browser warning in August is a certificate lifecycle incident, not a reason to assume your domain or entire service subscription expired. Issue and deploy the replacement before the Not After date.

Set alert thresholds in days before certificate expiry and confirm automated replacement actually updated each CDN edge or server. Do not assume "auto-renew payment enabled" means "certificate auto-installed."