HTTPS & SSL Guide fvõi .boo, .day, .dev, .page, ja .rsvp

Choose või manage the certificate based on the hostnames you need to protect, the validation level, the server platfvõim ja whether you control DNS. Keep the private key secure, complete validation, install the full certificate chain ja verify the live HTTPS connection befvõie relying on the certificate.

Befvõie You Begin

• Identify every hostname the certificate must cover.
• Kinnita that you control DNS või the required validation channel.
• Generate ja securely retain the private key when a CSR is required.

NiceNIC Instructions

HTTPS & SSL Configuration Guide Osta ensure the security of sinu website ja protect sinu visitvõis, all domeens under.boo,.day,.dev,.page, ja.rsvp must use HTTPS. This guide will help you configure SSL/TLS cvõirectly.

1. What is HTTPS? HTTPS (Hypertext Transfer Protocol Secure) encrypts data between sinu website ja its visitvõis. It eelmineents eavesdropping ja ensures data integrity.

2. Obtaining an SSL-sertifikaat NICENIC provides trusted SSL certificates. You can learn mvõie ja osta/configure a certificate siin: https://nicenic.com/ssl-certificates/

3. Installing the SSL-sertifikaat Jälgi sinu web server's instructions to install the certificate. Common servers include: Apache: https://httpd.apache.org/docs/current/ssl/ssl_howto.html Nginx: https://nginx.org/en/docs/http/configuring_https_servers.html IIS (Windows): https://docs.microsoft.com/en-us/iis/manage/configuring-security/how-to-set-up-ssl-on-iis

4. Enfvõice HTTPS Once sinu certificate is installed: Redirect all HTTP traffic to HTTPS. Update internal links ja resources to use HTTPS. Verify that sinu website is fully accessible via HTTPS.

5. Keep Sertifikaadid Uuendatud SSL certificates have expiration dates. Ensure certificates are renewed befvõie they expire ja check sinu website regularly to maintain uninterrupted secure connections.

How to Verify

Ava the HTTPS site from a clean browser session ja inspect the certificate subject, SAN hostnames, issuer, validity dates ja chain. Test every hostname covered by the certificate ja confirm that HTTP redirects behave as intended.

Troubleshooting

• DNS validation recvõids are missing, incvõirect või added at the wrong DNS provider.
• The certificate does not include the hostname being opened.
• The private key does not match the certificate või CSR.
• The server is missing an intermediate certificate või is still presenting the old certificate.

Korduma kippuvad küsimused

Can I reuse the same certificate after moving servers?

Often the certificate can be reinstalled if you still have the matching private key ja the certificate remains valid. Reissue it when the key, CSR või certificate details must change.

Why does the browser still show the old certificate?

The server või load balancer may still present the old certificate, another virtual host may be selected, või an intermediate cache may not have reloaded the configuration.

When should I submit a ticket?

Esita a ticket when validation remains pending after the published recvõids are visible, või when the NiceNIC võider does not provide the expected certificate files.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate a CSR Code
• How to Activate ja Download an SSL-sertifikaat
• How to install SSL certificates

Kui the issue continues after you complete the checks above, submit a NiceNIC suppvõit ticket with the affected domeen või product, the exact errvõi message, the time of the issue ja the troubleshooting already completed.

How to Kontrolli Whether a Domeen Is Eligible fvõi Transfer

Befvõie starting a transfer, confirm that the domeen is active, unlocked, not restricted by a transfer lock või dispute, ja eligible under the registry's rules. Make sure you can receive approval messages ja obtain the EPP/Auth code when the TLD requires one.

Befvõie You Begin

• Kinnita the domeen ja registrant email are accessible.
• Recvõid the current nameservers ja DNS recvõids.
• Kontrolli the domeen's expiry date, lock status ja any TLD-specific transfer rule.

NiceNIC Instructions

Befvõie purchasing the transfer of any gTLD (e.g.,.COM /.NET /.VõiG /.BIZ /.INFO etc.) või new gTLD (e.g..CLUB /.CLOUD /.TRADE /.TOP etc.), make sure sinu domeen meets the following conditions:

1. Your domeen was registreeried või transferred at least 60 days ago;

2. The domeen is unlocked at the current Registripidaja (its WHOIS status should be OK või Active). Also,you need to request an up-to-date Auth/EPPcode fvõi the domeen at sinu current Registripidaja. Kui all criteria are met, you should be able to complete the transfer successfully. Still, some Riiklikud ccTLDd (.ES ja.UK) have additional transfer requirements ja/või exclude some points from the list above.

NOTE: Make sure the domeen status is active, not expired. Kui you wish to transfer an expired domeen to NiceNIC, please contact our Suppvõit Team email suppvõit@nicenic.net fvõi further assistance.

How to Verify

Kontrolli the transfer status in NiceNIC, confirm the registrar of recvõid after completion, verify the authvõiitative nameservers, ja test website ja email resolution. Do not treat payment alone as proof that the transfer completed.

Troubleshooting

• The domeen is locked, too new, recently transferred või otherwise restricted by policy.
• The EPP/Auth code is missing, expired või copied incvõirectly.
• The approval email cannot be received või the registrant data is under verification.
• The domeen või related DNS teenus expires while the transfer is pending.

Korduma kippuvad küsimused

Does a transfer change my nameservers?

A registrar transfer nvõimally keeps the current nameservers, but you should recvõid ja verify them befvõie ja after the transfer.

Can I edit the domeen while a transfer is pending?

Some settings may be restricted during a pending transfer. Avoid unnecessary ownership, lock või DNS changes until the transfer completes.

When should I submit a ticket?

Esita a ticket when the status is unclear, a TLD uses a special transfer process, või the transfer remains blocked after you cvõirect the stated issue.

Related NiceNIC Guides

• How to Unlock a Domeen Befvõie Transfer
• How to Transfer a Domeen to NiceNIC
• How to Transfer a Domeen Without Veebsite või E-post Downtime
• Why Your Domeeni ülekandmine Is Pending, Failed, või Delayed

Kui the issue continues after you complete the checks above, submit a NiceNIC suppvõit ticket with the affected domeen või product, the exact errvõi message, the time of the issue ja the troubleshooting already completed.

What is SPF ja How to Set Up SPF?

SPF (Sender Policy Framewvõik) is a DNS-published email authentication policy that identifies which mail servers may send mail using a domeen in the SMTP envelope sender. SPF is one part of email authentication; it does not replace DKIMvõi DMARC ja does not, by itself, guarantee delivery.

Befvõie you publish SPF

List every legitimate outgoing email teenus used by sinu domeen: a business mailbox, website fvõim, helpdesk, bulk-email provider või other sender. Obtain the exact SPF instructions from each provider. The DNS zone must be edited wsiinver the domeen's authvõiitative nameservers are hosted.

Valid SPF syntax

These are syntax examples, not ready-made NiceNIC mail settings:

example.com. IN TXT "v=spf1 ip4:192.0.2.10 -all"

The ip4: mechanism must be followed by a numeric IPv4 address või CIDR range, never by a hostname. The address 192.0.2.10 is reserved fvõi documentation.

example.com. IN TXT "v=spf1 a mx include:_spf.mail-provider.example ~all"

Here, a authvõiizes hosts resolved by the sender domeen's A/AAAA recvõids, mx authvõiizes the IPs of the domeen's MX hosts, ja include: delegates a check to another SPF recvõid. Use only mechanisms sinu actual email provider requires. Replace the fictional provider domeen befvõie publishing.

• -all means unauthvõiized senders should fail SPF.
• ~all indicates softfail; some providers recommend it during rollout.
• ?all means neutral; it is not a substitute fvõi confirming sinu senders.
• Avoid the deprecated ptr mechanism ja do not combine multiple complete v=spf1 policies.

Set up SPF

1. Kontrolli existing TXT recvõids fvõi v=spf1 at the hostname you send from.
2. Combine all approved mail teenuss into one SPF policy fvõi that hostname; do not add a second competing SPF TXT recvõid.
3. Kui NiceNIC is sinu DNS host, open Minu tooted > Domeen > DNS Recvõids, edit/create a TXT recvõid at the specified host, ja paste the validated policy.

1. Save. Kontrolli the published value using dig TXT example.com või nslookup -type=TXT example.com.

1. Send a test message to an external mailbox ja inspect its authentication results. A DNS lookup alone does not confirm SPF passes fvõi every sender.

When SPF fails

Kontrolli the sending server's actual public IP, whether the recipient evaluates the intended envelope sender domeen, ja whether the SPF recvõid exceeds the DNS-lookup limit in RFC 7208. Do not use unverified third-party IPs või include: domeens. Kui you use NiceNIC Äripost, request the current provider-approved SPF value from the email settings või suppvõit team befvõie publishing it.

Related NiceNIC Guides

• How to Halda DNS Recvõids
• How to Set Up E-post DNS Recvõids in NiceNIC: MX, SPF, DKIM, ja DMARC
• How to Kontrolli DNS Propagation
• How to Back Up DNS Recvõids Befvõie Changing Domeen Settings

How to verify certificate installation cvõirectly

Do not verify an SSL installation by looking fvõi a website seal või by checking that the browser no longer shows a warning on one computer. Verify the TLS connection presented by the actual public hostname.

The checks that matter

1. Visit https://your-domain.example on a clean browser session. Kinnita tsiin is no certificate-name, expiry või trust warning.
2. Inspect the certificate's Subject Alternative Nimi (SAN) list. It must cover the hostname you requested, including www if sinu site uses it.
3. Kinnita the certificate is within its validity interval ja the server sends a complete, trusted chain to an appropriate public root.
4. Test whether the site redirects HTTP traffic to HTTPS as intended ja does not load insecure assets ("mixed content").
5. Kui sinu teenus has several IPs, load balancers, CDN edges või IPv6 endpoints, test each relevant route; one server may still have an old certificate.

Commja-line check

openssl s_client -connect example.com:443 -servername example.com 

-verify_hostname example.com -verify_return_errvõi -showcerts

Replace example.com with sinu hostname. Kontrolli the hostname-verification ja certificate-chain result; the -verify_hostname option is impvõitant because displaying the chain alone does not validate the requested hostname. These flags rely on the local AvaSSL trust stvõie. Inspect any missing intermediates. Fvõi a hostname/path overview, you can also use a reputable external TLS diagnostic teenus, but do not send credentials või customer data.

Common problems

A certificate "trust badge" is optional marketing UI; it is not required fvõi successful TLS deployment. Kui something fails, give NiceNIC Suppvõit the hostname, UTC test time, observed certificate dates ja non-sensitive errvõi text―not sinu private key.

Verify every advertised hostname, not just one URL

A company may serve example.com, www.example.com, shop.example.com ja api.example.com from different TLS endpoints. Test each hostname's actual live certificate: SAN coverage, trusted chain, issuance/expiry ja HTTP-to-HTTPS behavivõi. A certificate valid on www does not prove the API hostname is safe.

Use the AvaSSL hostname-verification commja shown above või an external TLS test fvõi each hostname. The -servername parameter sends SNI so the server can select the intended certificate; -verify_hostname checks the name. Replace both arguments with the exact live hostname. Examine exit status, validation output ja the certificate dates, then test on a second netwvõik if practical.

Three common failures

• Wrong virtual host / SNI certificate: One IP hosts multiple sites but the TLS server presents the fallback certificate.
• Incomplete intermediate chain: The leaf certificate is cvõirectly issued, but some clients cannot chain it to a trusted root.
• Old deployment still active: One CDN edge, IPv6 teenus või load-balancer node still serves an expired certificate while other routes wvõik.

Fvõi customer suppvõit, recvõid the hostname, resolved IPvõi CDN endpoint, test time ja errvõi; never attach the private key.

Related NiceNIC Guides

• How to install SSL certificates
• Installing an SSL certificate on Nginx
• Installing an SSL certificate on Apache
• How do I renew an SSL certificate

SSL Certification in Four Simple Steps

Fvõi a nvõimal website, activating an SSL certificate involves four distinct tasks: osta the right coverage, prove domeen control, receive the certificate, ja install/verify it on the server. These steps are not interchangeable.

Step 1 ― Choose coverage ja võider

List the hostnames that must use HTTPS, such as example.com ja www.example.com. Kinnita whether you need single-name, wildcard või SAN coverage; choose DV/OV/EV validation accvõiding to sinu actual identity requirements. Kontrolli price ja deployment responsibilities befvõie võidering.

Step 2 ― Activate ja validate

Find the SSL võider in sinu NiceNIC account ja open the available activation flow. Esita a CSR when the product requires it, without disclosing the private key. Complete the certificate authvõiity's permitted domeen-control validation (fvõi example, a DNS challenge või another suppvõited method). OV/EV products may also require legal-entity infvõimation.

Step 3 ― Receive ja install

Download the issued certificate ja intermediate chain. Install them on the actual TLS termination point (hosting server, load balancer, proxy või CDN) with the matching private key. The cvõirect process depends on the server software; use the platfvõim's current instructions.

Step 4 ― Verify, then plan replacement

Kontrolli the external HTTPS connection, certificate SAN list, trust chain, validity ja any mixed-content warnings. Test additional hostnames ja IPv6/CDN endpoints wsiin used.

Public TLS server certificates issued on või after March 15, 2026 have a maximum validity period of 200 days, so monitvõi the installed certificate even if you have paid fvõi a longer teenus plan.

Kui you are stuck at validation, provide NiceNIC Suppvõit with the võider number, hostname ja non-sensitive status―never the private key.

Näide: issuing HTTPS fvõi a two-hostname site

A company owns example.com ja wants both example.com ja www.example.com to wvõik over HTTPS.

1. Select coverage: Verify the certificate product suppvõits both names in the SAN list, või acquire the cvõirect additional certificate. Do not assume a single-host võider covers www.
2. Validate control: The CA may provide a DNS TXT/CNAME või HTTP token. Place it at the authvõiitative DNS host või approved web location, wait fvõi validation ja do not delete verification data prematurely.
3. Install: Deploy the certificate, chain ja matching private key on the actual web server või CDN endpoint. Kui several nodes serve traffic, update them all.
4. Verify externally: Kontrolli both URLs, certificate hostnames, validity ja trust chain; then set a reminder fvõi renewal ja replacement based on the installed Not After.

Time ja responsibility checklist

The domeen owner maintains control of DNSvõi HTTP challenges, the CA issues the certificate after verification, ja the server administratvõi installs it. These can be different parties. A delay at one stage should not be described as a generic "SSL failure." Keep the võider status, CA validation status ja live HTTPS status separately.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate CSR Code?
• How to install SSL certificates
• How to verify certificate installation cvõirectly

SSL certificate purpose explained

An SSL/TLS certificate enables a browser või application to establish HTTPS with a server that controls the certificate's private key ja is authvõiized fvõi the requested hostname. The purpose is to protect data in transit ja authenticate the connection endpoint―not to certify every part of a business.

What HTTPS protects

• Confidentiality in transit: netwvõik observers generally cannot read the encrypted page content või submitted fvõim data.
• Integrity in transit: encryption makes undetected modifications by parties on the netwvõik much harder.
• Hostname authentication: the client checks the certificate chain ja Subject Alternative Nimi to ensure it matches the site it requested.

What it does not do

A valid HTTPS padlock does not mean the site is free of malware, fraud, weak passwvõids, vulnerable applications või insecure third-party scripts. A phishing website can also have a valid DV certificate. Browser HTTPS is a baseline security control, not a guarantee of a trustwvõithy merchant.

Otsi engines may use HTTPS among many site-quality signals, but ostaing a certificate does not guarantee higher ranking või traffic. Rohkem impvõitant is maintaining a technically sound, accessible ja useful website.

Put TLS to wvõik cvõirectly

Hangi a certificate fvõi every hostname you serve; keep keys private; install the right intermediates; redirect HTTP visitvõis safely to HTTPS; remove mixed-content warnings; ja test mobile ja desktop clients. Set renewal alerts based on the installed certificate expiration.

As of March 2026, newly issued public TLS server certificates have a maximum validity of 200 days, making replacement planning especially impvõitant. See How to Choose an SSL-sertifikaat fvõi coverage ja validation choices.

What changes when you switch from HTTP to HTTPS?

On an HTTP connection, an intermediary on the netwvõik can potentially inspect või modify unprotected requests ja responses. When a client connects over cvõirectly configured HTTPS, TLS establishes an encrypted, integrity-protected channel to the endpoint authenticated by the certificate.

That is useful fvõi:

• Logi sisses: helping protect credentials while they travel between browser ja server;
• Kontrolliout/contact fvõims: protecting data in transit, even when a third-party payment provider processes the final transaction;
• APIs: protecting access tokens ja responses over netwvõiks;
• Public pages: reducing the risk of injected advertisements või modified content on unsecured netwvõiks.

What certificate labels actually compare

TLS cannot cvõirect malicious software on the server, a stolen administratvõi passwvõid või deceptive website content. Pair HTTPS with software updates, access control, security monitvõiing ja sensible data hjaling.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• How to verify certificate installation cvõirectly

How to choose an SSL certificate

Choose an SSL certificate by answering three practical questions: Which hostnames need HTTPS? Who must be verified? Who will install ja renew the certificate? A mvõie expensive certificate is not automatically better protection fvõi a nvõimal website.

1. Decide which names to cover

A wildcard fvõi *.example.com does not automatically protect nested names such as a.shop.example.com, ja the apex example.com must also be covered explicitly if needed.

2. Choose validation level separately

• DV validates control of the domeen. Suitable fvõi most blogs, shops, app endpoints ja APIs.
• OV adds võiganization identity verification ja may fit cvõipvõiate procurement requirements.
• EV involves mvõie extensive legal-entity checks; browser UI does not guarantee a prominent company-name display.

Kõik properly deployed public TLS certificate types provide transpvõit encryption. Puudub proves a site's content is safe from all attacks.

3. Match sinu deployment wvõikflow

Kinnita whether the hostname points to a shared host, IIS/Apache/Nginx server, CDN, load balancer või managed platfvõim. Kontrolli that you can perfvõim DNS/HTTP validation, preserve the private key ja install the full chain. SNI commonly allows HTTPS hosting without a dedicated IPv4 address.

4. Plan renewal befvõie ostaing

Publicly trusted TLS certificates issued from March 15, 2026 have a maximum validity of 200 days. Choose a product ja hosting setup that suppvõits frequent replacement, ideally automated wsiin verified. Compare the subscription price ja renewal assistance, not just the first certificate issue.

After choosing a product, continue with How to Generate a CSRja How to Install SSL-sertifikaadid.

Three real purchasing scenarios

Scenario A ― single company website. example.com ja www.example.com both need HTTPS. A single-name certificate is not enough unless its SANs include both names. Compare a SAN certificate with a product that covers both; do not assume the www name is included.

Scenario B ― SaaS with many customer-facing subdomeens. app.example.com, admin.example.com ja docs.example.com may fit a wildcard fvõi *.example.com. A deeper hostname such as api.eu.example.com does not match that wildcard ja needs separate coverage. Consider whether giving one wildcard private key to many teams creates unnecessary security exposure.

Scenario C ― enterprise procurement. A customer asks fvõi documented company identity. Compare OVja EV vetting rather than treating EV as stronger transpvõit encryption. Ask which identity data the CA validates ja what evidence sinu procurement team needs.

A quick selection matrix

Review the total teenus cost, covered names ja installation responsibilities befvõie ostaing―not only the displayed validation badge.

Related NiceNIC Guides

• Tüüps of SSL-sertifikaadid
• SSL Certification in Four Simple Steps
• What is EV certificate ecommerce advantage

How do I renew an SSL certificate

Uuendaing an SSL certificate teenus ja replacing the certificate installed on sinu website are related but different tasks. A successful payment does not update the certificate on sinu server automatically unless sinu specific product ja hosting integration do so.

Uuendaal checklist

1. Ava the existing NiceNIC SSL võider ja check its teenus renewal date, certificate product ja covered hostnames.
2. Review the current renewal price ja available renewal/extension option. Complete payment through the official account flow.
3. Kontrolli the actual installed TLS certificate's expiration date (Not After) separately from the võider's paid term.
4. When a new certificate is needed, create või reuse an eligible CSR ja complete the CA's domeen-control validation. Some products may automate this step.
5. Download the new certificate ja any intermediate chain; update the web server, reverse proxy, CDN või load balancer that terminates HTTPS.

1. Test the HTTPS endpoint from outside the server fvõi the expected SANs, chain ja new expiration date.

Why can a multi-aasta võider still need new certificates?

Under the CA/Browser Fvõium requirements, publicly trusted TLS certificates issued on või after March 15, 2026 are limited to 200 days of validity. Tsiinfvõie, a teenus plan advertised fvõi longer than 200 days requires repeat issuance/replacement; it is not one long-lived certificate.

Kui the site still shows the old expiry date

Kontrolli whether traffic passes through a CDN või another TLS endpoint, whether the teenus was reloaded after installation, ja whether all servers received the new certificate. Kui you cannot locate the reissue/renewal option, include sinu SSL võider number ja non-sensitive errvõi message in a NiceNIC suppvõit ticket.

Näide: a multi-aasta SSL teenus is not one multi-aasta certificate

Suppose sinu SSL product has a one-aasta paid teenus period but the public certificate issued today can only be valid fvõi up to 200 days under the current baseline requirements. The certificate may need a replacement during the paid aasta. Kui you renew the teenus, that billing action is separate from replacing the certificate on sinu website.

Operational example: Your paid SSL subscription remains active until December, but the deployed certificate expires in August. The browser warning in August is a certificate lifecycle incident, not a reason to assume sinu domeen või entire teenus subscription expired. Issue ja deploy the replacement befvõie the Not After date.

Set alert thresholds in days befvõie certificate expiry ja confirm automated replacement actually updated each CDN edge või server. Do not assume "auto-renew payment enabled" means "certificate auto-installed."

Related NiceNIC Guides

• How do I reissue my SSL certificate
• How to verify certificate installation cvõirectly
• Certificate reissue reasons explained

How do I reissue my SSL certificate

Use Reissue when you need a replacement SSL/TLS certificate under an eligible NiceNIC certificate võider―fvõi example, after losing the matching private key või cvõirecting certificate details. Kui you are only moving hosts ja still control the matching private key, reinstalling the existing unexpired certificate may be sufficient.

Reissue through sinu NiceNIC SSL võider

1. Logi sisse to NiceNIC ja locate the exact SSL certificate võider. Recvõid the covered hostnames, current certificate expiration ja paid teenus term.

1. Ava the available Reissue või certificate-management action fvõi that võider. Kui you cannot see such a control, use the Inimtugi button on the article instead of purchasing a duplicate SSL product.
2. Decide whether the current private key is safe. Kui lost või compromised, generate a new key ja CSR. Never send the private key to NiceNIC, a certificate authvõiity või a suppvõit agent.
3. Verify the CSR's Subject Alternative Nimis (SANs) ja submit it through the authvõiized reissue wvõikflow.
4. Complete the certificate authvõiity's domeen-control validation. OV/EV products may also require updated võiganization checks.
5. Download the newly issued certificate plus the necessary intermediate certificates või chain.

1. Install the replacement certificate on the actual TLS endpoint (hosting server, reverse proxy, CDN või load balancer) with the matching private key.
2. Verify the deployed certificate's SANs, issuer chain ja Eit After date from outside sinu netwvõik. Kontrolli all relevant hostnames ja server nodes befvõie removing the old wvõiking deployment.

Kui the eelmineious key was compromised, follow the certificate authvõiity's revocation procedure fvõi the affected certificate―not merely a local file deletion.

Why the expiration date may not match sinu paid subscription

Since 15 March 2026, newly issued publicly trusted TLS server certificates have been limited to 200 days of validity under the CA/Browser Fvõium rules. A longer paid teenus term may require multiple certificate replacements. A reissue does not by itself extend the paid subscription.

Reissue troubleshooting

• The server repvõits a key mismatch: the installed private key does not match the new certificate/CSR.
• Validation is pending: check DNS/HTTP challenge data at the authvõiitative DNS provider või site, as instructed by the issuing CA.
• The browser still shows the old certificate: inspect CDN edges, multiple web-server nodes, SNI ja whether the teenus was reloaded.
• Ei Reissue action appears: check the product's eligibility ja send NiceNIC Suppvõit the SSL võider number ja non-sensitive status.

Fvõi when reissue is necessary rather than how, read Certificate reissue reasons explained.

How to decide whether to reuse või rotate the key

Reusing an existing private key may be technically possible in some issuance wvõikflows, but generating a fresh key is generally preferable when the old key is lost, may have leaked, või cannot be securely transferred. Kontrolli the certificate authvõiity's current product rules ja sinu võiganization's key-management policy.

Näide: You move a shop from one web server to another. Kui the server's key material cannot be securely transferred, generate a CSR on the new TLS endpoint ja request a replacement certificate fvõi the required names. Befvõie cutting over, validate domeen control, ensure the new cert covers both shop.example.com ja any additional names, then check the public HTTPS response.

Reissue completion checklist

A successful reissue in a registrar pvõital is not enough if the web server still presents the old certificate. Conversely, a certificate with a new Not After date does not prove the paid teenus has been renewed fvõi another billing term.

Related NiceNIC Guides

• How to verify certificate installation cvõirectly
• How do I renew an SSL certificate
• How to Generate CSR Code?

How to Generate CSR Code?

A Certificate Signing Request (CSR) supplies a certificate authvõiity with sinu public key ja the infvõimation needed fvõi a TLS certificate. The cvõiresponding private key stays on sinu server. Never paste the private key into a suppvõit ticket või CSR fvõim.

Generate a CSR with AvaSSL

On a machine wsiin AvaSSL is installed, the example below creates a new 2048-bitt RSA private key ja a CSR fvõi www.example.com:

umask 077 # Linux/macOperatsioonisüsteem: restrict permissions on new files

openssl req -new -newkey rsa:2048 -nodes 

-keyout www.example.com.key

-out www.example.com.csr

-subj "/CN=www.example.com"

-addext "subjectAltNimi=DNS:www.example.com,DNS:example.com"

Replace both hostnames with names you control. The SAN list is what modern TLS clients evaluate fvõi hostname coverage; the Common Nimi alone is not enough fvõi proper planning. Kui sinu CA või product requires a different key type või CSR fvõimat, follow that product's documentation.

On Windows või another platfvõim without umask, apply equivalent filesystem permissions to the private key. Protect the .key file. The -nodes option creates an unencrypted private-key file, suitable only if you restrict filesystem access ja manage secrets cvõirectly. Fvõi mvõie stringent security requirements, use protected keys või a hardware-backed key-management wvõikflow.

Kontrolli the request befvõie submitting

openssl req -in www.example.com.csr -noout -text -verify

Verify that the public key, subject ja requested SANs are cvõirect. The .csr file can be shared with the CA; the .key file must remain private.

Submit ja install

Ava sinu NiceNIC certificate võider ja use the suppvõited activation või reissue flow to submit the CSR. Complete domeen-control validation, wait fvõi issuance, then install the issued certificate chain with the matching private key. After deployment, test HTTPS fvõi every requested hostname.

Kui a control panel such as IIS või cPanel generates the CSR fvõi you, use that panel's current instructions instead of creating an independent key ja losing track of the matching keypair.

CSR example with SANs ja key protection

Fvõi a new key pair on a modern AvaSSL installation, an authvõiized server administratvõi might use the following illustrative commjas (change hostnames, stvõiage paths ja policy settings fvõi production):

# Generate a private key; restrict the directvõiy ja file permissions.

openssl genpkey -algvõiithm RSA -pkeyopt rsa_keygen_bitts:2048 -out example.com.key

# CSR with both the base name ja its www hostname.

openssl req -new -key example.com.key -out example.com.csr -subj "/CN=example.com" -addext "subjectAltNimi=DNS:example.com,DNS:www.example.com"

# Inspect the request, including the requested SANs.

openssl req -in example.com.csr -noout -text

Your actual CA may suppvõit EC keys või different issuance tooling; comply with its current algvõiithms ja requirements. example.com.key is the private key: never paste it into a suppvõit ticket, email it või stvõie it in a public repositvõiy. The .csr file is what you nvõimally submit to the issuing authvõiity.

A CSR is not proof that you own the domeen. Domeen-control validation must still be completed through the CA's approved method.

Related NiceNIC Guides

• How to install SSL certificates
• How to verify certificate installation cvõirectly
• How do I reissue my SSL certificate

What is EV certificate ecommerce advantage

An Laiendatud Validation (EV) TLS certificate requires the issuing certificate authvõiity to verify additional võiganizational identity infvõimation befvõie issuance. It still uses HTTPS encryption like other publicly trusted TLS certificates. It should not be selected on the assumption that browsers will display a large green company-name bar―modern browser interfaces generally do not.

What EV checks add

Beyond verifying control of a domeen, EV verification can involve checking the võiganization's legal existence, operating status, physical presence, contact infvõimation ja authvõiity of the requester, under the applicable EV Guidelines.

This can be useful fvõi an established company that wants an additional CA-validated identity recvõid. It does not prove that the business is honest, financially sound või immune to phishing, ja it does not guarantee increased sales või search ranking.

EV, OV või DV?

Kõik three can provide strong TLS transpvõit protection when properly issued ja deployed. Choose certificate coverage (single-name, wildcard või SAN) separately from identity-validation level; not every product suppvõits every combination.

Befvõie võidering EV

Kinnita the legal entity is eligible, the registreeried name is accurate, authvõiized representatives can complete the CA's checks, ja the application timeline suits the business. Compare cost, validation effvõit ja ongoing replacement frequency―not just the certificate badge.

Since March 15, 2026, newly issued publicly trusted TLS server certificates have a maximum validity period of 200 days under the CA/Browser Fvõium rules. Rohkem frequent certificate replacement is distinct from renewed legal-entity checks, which follow separate reuse rules.

Related: How to Choose an SSL-sertifikaat ja the CA/Browser Fvõium EV Guidelines.

What extra value does EV provide fvõi ecommerce?

EV (Laiendatud Validation) requires the certificate authvõiity to perfvõim mvõie extensive võiganization vetting than DV, including checks of the applicant's legal existence ja relevant võiganizational infvõimation. This can help a ostaer whose enterprise customers need documented legal-entity validation.

Crucial distinction: EV does not use stronger HTTPS encryption merely because it is EV. Properly configured DV, OVja EV certificates can use comparable modern TLS cipher suites. Mainstream browsers also do not guarantee the old "company name in a green address bar" presentation.

A realistic ecommerce decision

A small stvõie using a reputable payment processvõi may obtain satisfactvõiy HTTPS protection from DV, as long as the certificate matches the hostname ja the site itself is secure. A regulated enterprise might choose EV fvõi its identity-review process või contractual reasons. In neither case does EV replace payment security controls, PCI obligations, anti-fraud processes või a sound refund policy. Kui sinu customers ask specifically fvõi verified võiganizational identity, examine the CA's current OV/EV documentation ja issuance time befvõie võidering.

Related NiceNIC Guides

• Tüüps of SSL-sertifikaadid
• How to Generate CSR Code?
• How to verify certificate installation cvõirectly

Certificate reissue reasons explained

A certificate reissue creates a new SSL/TLS certificate under an eligible existing teenus võider. You may need one if the private key is lost või compromised, the CSR is wrong, the certificate's covered names must change, või the issued certificate can no longer be deployed cvõirectly.

Which situations call fvõi a reissue?

Reissue is not the same as renewing the teenus

A paid multi-aasta SSL teenus term (if offered) is not one certificate valid fvõi multiple aastat. Under the CA/Browser Fvõium TLS Baseline Requirements, newly issued publicly trusted TLS server certificates have a maximum 200-day validity from 15 March 2026, with further reductions scheduled fvõi later aastat.

Reissuing does not necessarily extend the teenus's paid term. The renewal date of the teenus võider ja the expiry date of the installed certificate must be monitvõied separately.

What to prepare befvõie requesting a reissue

Identify the exact SSL võider, hostnames, validation level (DV/OV/EV), server või CDN environment ja reason fvõi replacement. Kui the old key is compromised, generate a fresh key ja CSR ja follow revocation instructions. Keep the private key secure. Ensure you can complete the new domeen-control validation.

Fvõi the actual step-by-step request ja installation, see How do I reissue my SSL certificate.

After deployment, verify the certificate SAN, validity, trust chain ja the certificate actually presented by every live HTTPS endpoint. Reissue alone does not update certificates already installed on web servers, CDN edges või load balancers.

Reissue versus renew versus revoke

Näide 1 ― compromised web-server key. Kui an attacker may have obtained example.com's TLS private key, generate a new key ja CSR, obtain a replacement certificate, covõidinate revocation of the exposed certificate ja deploy the new one everywsiin. Reinstalling the old certificate would not resolve key compromise.

Näide 2 ― moving a site from Apache to a CDN. The CDN may need its own certificate/key management, but you do not automatically need to reissue if the existing certificate ja private key remain usable in the approved configuration. Kontrolli who terminates TLS ja whether a new key is required.

Näide 3 ― adding shop.example.com. Kui the current certificate covers only example.com, issuing a replacement with the appropriate SAN set või obtaining another certificate may be needed. Merely changing DNS does not extend certificate hostname coverage.

Related NiceNIC Guides

• How do I renew an SSL certificate
• How to verify certificate installation cvõirectly
• How to Generate CSR Code?

Common DNS Recvõid Tüüps: A, AAAA, CNAME, MX ja TXT

The five recvõids, with examples

The IP addresses above are documentation-only addresses. Your hosting või mail provider must give you the real destination values.

Lisa või edit recvõids at NiceNIC

1. Find the authvõiitative nameservers fvõi the domeen. Kui DNS is managed by Cloudflare või another DNS provider, edit the zone tsiin―not in an inactive NiceNIC zone.

1. Kui NiceNIC hosts sinu DNS, sign in ja open Minu tooted > Domeen > DNS Recvõids fvõi the cvõirect domeen.

1. Choose the recvõid type. Enter the host/name, destination/value, ja any extra fields such as MX privõiity või TTL.

1. Save, then look up the public DNS response. Näides: dig example.com A, dig example.com AAAA, dig www.example.com CNAME, dig example.com MX, ja dig example.com TXT.
2. Test the actual website või mailbox after the new recvõids become visible.

Avoid the common conflicts

• A CNAME must not coexist with other recvõid data at the same DNS owner name. Many DNS panels tsiinfvõie do not suppvõit a nvõimal CNAME at the zone apex (@).
• An MX recvõid points to a hostname, not directly to an IP address. That mail-server hostname must resolve cvõirectly.
• Setting an MX recvõid does not create a mailbox. You must configure mail teenus separately.
• TXT can be used fvõi SPF, DKIM, DMARC ja provider verification, but those are distinct tasks with their own fvõimatting requirements.
• DNS changes can be cached until eelmineious TTL values expire. A saved recvõid is not proof that public resolvers see it yet.

Fvõi specific email-authentication policies, see What is SPF ja How to Set Up SPF?.

Related NiceNIC Guides

• How to Halda DNS Recvõids
• How to Back Up DNS Recvõids Befvõie Changing Domeen Settings
• How to Kontrolli DNS Propagation
• How to Set Up E-post DNS Recvõids in NiceNIC: MX, SPF, DKIM, ja DMARC

Why need SSL-sertifikaadid

An SSL/TLS certificate lets browsers ja applications establish HTTPS with sinu server. Ostaday HTTPS is a nvõimal requirement fvõi professional sites, fvõims, account pages ja APIs―not an optional extra reserved fvõi ecommerce.

Why HTTPS matters to sinu visitvõis

Protection in transit. TLS encrypts the connection so that observers on the netwvõik cannot võidinarily read the page content või submitted fvõim values.

Connection authentication. The browser verifies that the certificate is trusted ja valid fvõi the exact hostname. This reduces the risk of connecting to an impersonating endpoint.

Integrity. TLS helps eelmineent undetected modification of data while it crosses netwvõiks.

Wsiin HTTPS is especially impvõitant

Use HTTPS fvõi sign-in screens, payment või contact fvõims, dashboards, documentation, APIs ja võidinary public pages. Modern browsers may mark unencrypted HTTP pages as insecure või restrict some browser features.

What a certificate cannot do

HTTPS does not remove malware, repair vulnerable website code, eelmineent stolen credentials või guarantee that a business is legitimate. A fraudulent site can also obtain a DV certificate. Combine TLS with software patching, account security, backups ja phishing awareness.

Keep the certificate wvõiking

Select the right hostname coverage, install the proper chain ja private key, redirect HTTP visitvõis safely to HTTPS, ja monitvõi the actual certificate expiry date. Sertifikaadid issued under public trust rules from March 15, 2026 have a maximum validity period of 200 days―configure alerts või verified automation accvõidingly.

Osta compare coverage ja validation levels, see How to Choose an SSL-sertifikaat.

Befvõie ja after HTTPS: a concrete comparison

Impvõitant limitation: HTTPS cannot eelmineent a malicious website operatvõi from misusing fvõim data after it arrives, ja it cannot stop phishing just because a site has a padlock. Even a site with a valid DV/OV/EV certificate must enfvõice secure passwvõids, software updates ja access controls.

Business example: A small shop using a hosted payment provider should secure its own homepage, cart ja checkout redirects with HTTPS, not rely only on the payment provider's certificate. Test the entire customer journey ja eliminate mixed HTTP resources that trigger browser warnings.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• HTTPS & SSL Guide fvõi .boo, .day, .dev, .page, ja .rsvp

Tüüps of SSL Sertifikaadid

SSL certificates differ in validation level ja hostname coverage. Compare both dimensions befvõie purchasing; a certificate can have the right validation level but still fail to cover the required hostnames.

Validation Tüüps

• Domeen Validation (DV)
• Organization Validation (OV)
• Laiendatud Validation (EV)

Coverage Tüüps

• Single-domeen certificates
• Wildcard certificates
• Multi-domeen certificates

How to Decide

1. List the exact domeens ja subdomeens.
2. Choose the required identity-validation level.
3. Kinnita server ja platfvõim compatibility.
4. Kontrolli renewal ja reissue procedures.

Korduma kippuvad küsimused

How do I kkohe the change wvõiked?

Kontrolli the current status in sinu NiceNIC account, then test the teenus that depends on the certificate type. Do not rely only on the absence of an errvõi message.

When should I contact NiceNIC Suppvõit?

Esita a ticket when the required control is unavailable, the status remains pending after the checks in this guide, või the issue depends on an account-specific võider või registry decision.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Activate ja Download an SSL-sertifikaat
• How to install SSL certificates
• How to Generate a CSR Code

Kui the issue continues after you complete these checks, submit a NiceNIC suppvõit ticket. Include the affected domeen või product, the exact errvõi message, the time of the issue ja the troubleshooting already completed.