HTTPS & SSL Guide ftai .boo, .day, .dev, .page, ja .rsvp

Choose tai manage the certificate based on the hostnames you need to protect, the validation level, the server platftaim ja whether you control DNS. Keep the private key secure, complete validation, install the full certificate chain ja verify the live HTTPS connection beftaie relying on the certificate.

Beftaie You Begin

• Identify every hostname the certificate must cover.
• Vahvista that you control DNS tai the required validation channel.
• Generate ja securely retain the private key when a CSR is required.

NiceNIC Instructions

HTTPS & SSL Configuration Guide Osta ensure the security of sinun website ja protect sinun visittais, all verkkotunnuss under.boo,.day,.dev,.page, ja.rsvp must use HTTPS. This guide will help you configure SSL/TLS ctairectly.

1. What is HTTPS? HTTPS (Hypertext Transfer Protocol Secure) encrypts data between sinun website ja its visittais. It edellinenents eavesdropping ja ensures data integrity.

2. Obtaining an SSL-sertifikaatti NICENIC provides trusted SSL certificates. You can learn mtaie ja osta/configure a certificate tässä: https://nicenic.com/ssl-certificates/

3. Installing the SSL-sertifikaatti Seuraa sinun web server's instructions to install the certificate. Common servers include: Apache: https://httpd.apache.org/docs/current/ssl/ssl_howto.html Nginx: https://nginx.org/en/docs/http/configuring_https_servers.html IIS (Windows): https://docs.microsoft.com/en-us/iis/manage/configuring-security/how-to-set-up-ssl-on-iis

4. Enftaice HTTPS Once sinun certificate is installed: Redirect all HTTP traffic to HTTPS. Update internal links ja resources to use HTTPS. Verify that sinun website is fully accessible via HTTPS.

5. Keep Sertifikaatit Päivitetty SSL certificates have expiration dates. Ensure certificates are renewed beftaie they expire ja check sinun website regularly to maintain uninterrupted secure connections.

How to Verify

Avoin the HTTPS site from a clean browser session ja inspect the certificate subject, SAN hostnames, issuer, validity dates ja chain. Test every hostname covered by the certificate ja confirm that HTTP redirects behave as intended.

Troubleshooting

• DNS validation rectaids are missing, inctairect tai added at the wrong DNS provider.
• The certificate does not include the hostname being opened.
• The private key does not match the certificate tai CSR.
• The server is missing an intermediate certificate tai is still presenting the old certificate.

Usein kysytyt kysymykset

Can I reuse the same certificate after moving servers?

Often the certificate can be reinstalled if you still have the matching private key ja the certificate remains valid. Reissue it when the key, CSR tai certificate details must change.

Why does the browser still show the old certificate?

The server tai load balancer may still present the old certificate, another virtual host may be selected, tai an intermediate cache may not have reloaded the configuration.

When should I submit a ticket?

Lähetä a ticket when validation remains pending after the published rectaids are visible, tai when the NiceNIC taider does not provide the expected certificate files.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate a CSR Code
• How to Activate ja Download an SSL-sertifikaatti
• How to install SSL certificates

Jos the issue continues after you complete the checks above, submit a NiceNIC supptait ticket with the affected verkkotunnus tai product, the exact errtai message, the time of the issue ja the troubleshooting already completed.

How to Tarkista Whether a Verkkotunnus Is Eligible ftai Transfer

Beftaie starting a transfer, confirm that the verkkotunnus is active, unlocked, not restricted by a transfer lock tai dispute, ja eligible under the registry's rules. Make sure you can receive approval messages ja obtain the EPP/Auth code when the TLD requires one.

Beftaie You Begin

• Vahvista the verkkotunnus ja registrant email are accessible.
• Rectaid the current nameservers ja DNS rectaids.
• Tarkista the verkkotunnus's expiry date, lock status ja any TLD-specific transfer rule.

NiceNIC Instructions

Beftaie purchasing the transfer of any gTLD (e.g.,.COM /.NET /.TAIG /.BIZ /.INFO etc.) tai new gTLD (e.g..CLUB /.CLOUD /.TRADE /.TOP etc.), make sure sinun verkkotunnus meets the following conditions:

1. Your verkkotunnus was rekisteröied tai transferred at least 60 days ago;

2. The verkkotunnus is unlocked at the current Rekisterinpitäjä (its WHOIS status should be OK tai Active). Also,you need to request an up-to-date Auth/EPPcode ftai the verkkotunnus at sinun current Rekisterinpitäjä. Jos all criteria are met, you should be able to complete the transfer successfully. Still, some alueen pääte (ccTLD) (.ES ja.UK) have additional transfer requirements ja/tai exclude some points from the list above.

NOTE: Make sure the verkkotunnus status is active, not expired. Jos you wish to transfer an expired verkkotunnus to NiceNIC, please contact our Supptait Team email supptait@nicenic.net ftai further assistance.

How to Verify

Tarkista the transfer status in NiceNIC, confirm the registrar of rectaid after completion, verify the authtaiitative nameservers, ja test website ja email resolution. Do not treat payment alone as proof that the transfer completed.

Troubleshooting

• The verkkotunnus is locked, too new, recently transferred tai otherwise restricted by policy.
• The EPP/Auth code is missing, expired tai copied inctairectly.
• The approval email cannot be received tai the registrant data is under verification.
• The verkkotunnus tai related DNS palvelu expires while the transfer is pending.

Usein kysytyt kysymykset

Does a transfer change my nameservers?

A registrar transfer ntaimally keeps the current nameservers, but you should rectaid ja verify them beftaie ja after the transfer.

Can I edit the verkkotunnus while a transfer is pending?

Some settings may be restricted during a pending transfer. Avoid unnecessary ownership, lock tai DNS changes until the transfer completes.

When should I submit a ticket?

Lähetä a ticket when the status is unclear, a TLD uses a special transfer process, tai the transfer remains blocked after you ctairect the stated issue.

Related NiceNIC Guides

• How to Unlock a Verkkotunnus Beftaie Transfer
• How to Transfer a Verkkotunnus to NiceNIC
• How to Transfer a Verkkotunnus Without Verkkosite tai Sähköposti Downtime
• Why Your Domainin siirto Is Pending, Failed, tai Delayed

Jos the issue continues after you complete the checks above, submit a NiceNIC supptait ticket with the affected verkkotunnus tai product, the exact errtai message, the time of the issue ja the troubleshooting already completed.

What is SPF ja How to Set Up SPF?

SPF (Sender Policy Framewtaik) is a DNS-published email authentication policy that identifies which mail servers may send mail using a verkkotunnus in the SMTP envelope sender. SPF is one part of email authentication; it does not replace DKIMtai DMARC ja does not, by itself, guarantee delivery.

Beftaie you publish SPF

List every legitimate outgoing email palvelu used by sinun verkkotunnus: a business mailbox, website ftaim, helpdesk, bulk-email provider tai other sender. Obtain the exact SPF instructions from each provider. The DNS zone must be edited wtässäver the verkkotunnus's authtaiitative nameservers are hosted.

Valid SPF syntax

These are syntax examples, not ready-made NiceNIC mail settings:

example.com. IN TXT "v=spf1 ip4:192.0.2.10 -all"

The ip4: mechanism must be followed by a numeric IPv4 address tai CIDR range, never by a hostname. The address 192.0.2.10 is reserved ftai documentation.

example.com. IN TXT "v=spf1 a mx include:_spf.mail-provider.example ~all"

Here, a authtaiizes hosts resolved by the sender verkkotunnus's A/AAAA rectaids, mx authtaiizes the IPs of the verkkotunnus's MX hosts, ja include: delegates a check to another SPF rectaid. Use only mechanisms sinun actual email provider requires. Replace the fictional provider verkkotunnus beftaie publishing.

• -all means unauthtaiized senders should fail SPF.
• ~all indicates softfail; some providers recommend it during rollout.
• ?all means neutral; it is not a substitute ftai confirming sinun senders.
• Avoid the deprecated ptr mechanism ja do not combine multiple complete v=spf1 policies.

Set up SPF

1. Tarkista existing TXT rectaids ftai v=spf1 at the hostname you send from.
2. Combine all approved mail palvelus into one SPF policy ftai that hostname; do not add a second competing SPF TXT rectaid.
3. Jos NiceNIC is sinun DNS host, open Omat tuotteet > Verkkotunnus > DNS Rectaids, edit/create a TXT rectaid at the specified host, ja paste the validated policy.

1. Save. Tarkista the published value using dig TXT example.com tai nslookup -type=TXT example.com.

1. Send a test message to an external mailbox ja inspect its authentication results. A DNS lookup alone does not confirm SPF passes ftai every sender.

When SPF fails

Tarkista the sending server's actual public IP, whether the recipient evaluates the intended envelope sender verkkotunnus, ja whether the SPF rectaid exceeds the DNS-lookup limit in RFC 7208. Do not use unverified third-party IPs tai include: verkkotunnuss. Jos you use NiceNIC Yritys­sähköposti, request the current provider-approved SPF value from the email settings tai supptait team beftaie publishing it.

Related NiceNIC Guides

• How to Hallinnoi DNS Rectaids
• How to Set Up Sähköposti DNS Rectaids in NiceNIC: MX, SPF, DKIM, ja DMARC
• How to Tarkista DNS Propagation
• How to Back Up DNS Rectaids Beftaie Changing Verkkotunnus Settings

How to verify certificate installation ctairectly

Do not verify an SSL installation by looking ftai a website seal tai by checking that the browser no longer shows a warning on one computer. Verify the TLS connection presented by the actual public hostname.

The checks that matter

1. Visit https://your-domain.example on a clean browser session. Vahvista ttässä is no certificate-name, expiry tai trust warning.
2. Inspect the certificate's Subject Alternative Nimi (SAN) list. It must cover the hostname you requested, including www if sinun site uses it.
3. Vahvista the certificate is within its validity interval ja the server sends a complete, trusted chain to an appropriate public root.
4. Test whether the site redirects HTTP traffic to HTTPS as intended ja does not load insecure assets ("mixed content").
5. Jos sinun palvelu has several IPs, load balancers, CDN edges tai IPv6 endpoints, test each relevant route; one server may still have an old certificate.

Commja-line check

openssl s_client -connect example.com:443 -servername example.com 

-verify_hostname example.com -verify_return_errtai -showcerts

Replace example.com with sinun hostname. Tarkista the hostname-verification ja certificate-chain result; the -verify_hostname option is imptaitant because displaying the chain alone does not validate the requested hostname. These flags rely on the local AvoinSSL trust sttaie. Inspect any missing intermediates. Ftai a hostname/path overview, you can also use a reputable external TLS diagnostic palvelu, but do not send credentials tai customer data.

Common problems

A certificate "trust badge" is optional marketing UI; it is not required ftai successful TLS deployment. Jos something fails, give NiceNIC Supptait the hostname, UTC test time, observed certificate dates ja non-sensitive errtai text―not sinun private key.

Verify every advertised hostname, not just one URL

A company may serve example.com, www.example.com, shop.example.com ja api.example.com from different TLS endpoints. Test each hostname's actual live certificate: SAN coverage, trusted chain, issuance/expiry ja HTTP-to-HTTPS behavitai. A certificate valid on www does not prove the API hostname is safe.

Use the AvoinSSL hostname-verification commja shown above tai an external TLS test ftai each hostname. The -servername parameter sends SNI so the server can select the intended certificate; -verify_hostname checks the name. Replace both arguments with the exact live hostname. Examine exit status, validation output ja the certificate dates, then test on a second netwtaik if practical.

Three common failures

• Wrong virtual host / SNI certificate: One IP hosts multiple sites but the TLS server presents the fallback certificate.
• Incomplete intermediate chain: The leaf certificate is ctairectly issued, but some clients cannot chain it to a trusted root.
• Old deployment still active: One CDN edge, IPv6 palvelu tai load-balancer node still serves an expired certificate while other routes wtaik.

Ftai customer supptait, rectaid the hostname, resolved IPtai CDN endpoint, test time ja errtai; never attach the private key.

Related NiceNIC Guides

• How to install SSL certificates
• Installing an SSL certificate on Nginx
• Installing an SSL certificate on Apache
• How do I renew an SSL certificate

SSL Certification in Four Simple Steps

Ftai a ntaimal website, activating an SSL certificate involves four distinct tasks: osta the right coverage, prove verkkotunnus control, receive the certificate, ja install/verify it on the server. These steps are not interchangeable.

Step 1 ― Choose coverage ja taider

List the hostnames that must use HTTPS, such as example.com ja www.example.com. Vahvista whether you need single-name, wildcard tai SAN coverage; choose DV/OV/EV validation acctaiding to sinun actual identity requirements. Tarkista price ja deployment responsibilities beftaie taidering.

Step 2 ― Activate ja validate

Find the SSL taider in sinun NiceNIC account ja open the available activation flow. Lähetä a CSR when the product requires it, without disclosing the private key. Complete the certificate authtaiity's permitted verkkotunnus-control validation (ftai example, a DNS challenge tai another supptaited method). OV/EV products may also require legal-entity inftaimation.

Step 3 ― Receive ja install

Download the issued certificate ja intermediate chain. Install them on the actual TLS termination point (hosting server, load balancer, proxy tai CDN) with the matching private key. The ctairect process depends on the server software; use the platftaim's current instructions.

Step 4 ― Verify, then plan replacement

Tarkista the external HTTPS connection, certificate SAN list, trust chain, validity ja any mixed-content warnings. Test additional hostnames ja IPv6/CDN endpoints wtässä used.

Public TLS server certificates issued on tai after March 15, 2026 have a maximum validity period of 200 days, so monittai the installed certificate even if you have paid ftai a longer palvelu plan.

Jos you are stuck at validation, provide NiceNIC Supptait with the taider number, hostname ja non-sensitive status―never the private key.

Esimerkki: issuing HTTPS ftai a two-hostname site

A company owns example.com ja wants both example.com ja www.example.com to wtaik over HTTPS.

1. Select coverage: Verify the certificate product supptaits both names in the SAN list, tai acquire the ctairect additional certificate. Do not assume a single-host taider covers www.
2. Validate control: The CA may provide a DNS TXT/CNAME tai HTTP token. Place it at the authtaiitative DNS host tai approved web location, wait ftai validation ja do not delete verification data prematurely.
3. Install: Deploy the certificate, chain ja matching private key on the actual web server tai CDN endpoint. Jos several nodes serve traffic, update them all.
4. Verify externally: Tarkista both URLs, certificate hostnames, validity ja trust chain; then set a reminder ftai renewal ja replacement based on the installed Not After.

Time ja responsibility checklist

The verkkotunnus owner maintains control of DNStai HTTP challenges, the CA issues the certificate after verification, ja the server administrattai installs it. These can be different parties. A delay at one stage should not be described as a generic "SSL failure." Keep the taider status, CA validation status ja live HTTPS status separately.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate CSR Code?
• How to install SSL certificates
• How to verify certificate installation ctairectly

SSL certificate purpose explained

An SSL/TLS certificate enables a browser tai application to establish HTTPS with a server that controls the certificate's private key ja is authtaiized ftai the requested hostname. The purpose is to protect data in transit ja authenticate the connection endpoint―not to certify every part of a business.

What HTTPS protects

• Confidentiality in transit: netwtaik observers generally cannot read the encrypted page content tai submitted ftaim data.
• Integrity in transit: encryption makes undetected modifications by parties on the netwtaik much harder.
• Hostname authentication: the client checks the certificate chain ja Subject Alternative Nimi to ensure it matches the site it requested.

What it does not do

A valid HTTPS padlock does not mean the site is free of malware, fraud, weak passwtaids, vulnerable applications tai insecure third-party scripts. A phishing website can also have a valid DV certificate. Browser HTTPS is a baseline security control, not a guarantee of a trustwtaithy merchant.

Haku engines may use HTTPS among many site-quality signals, but ostaing a certificate does not guarantee higher ranking tai traffic. Lisää imptaitant is maintaining a technically sound, accessible ja useful website.

Put TLS to wtaik ctairectly

Hanki a certificate ftai every hostname you serve; keep keys private; install the right intermediates; redirect HTTP visittais safely to HTTPS; remove mixed-content warnings; ja test mobile ja desktop clients. Set renewal alerts based on the installed certificate expiration.

As of March 2026, newly issued public TLS server certificates have a maximum validity of 200 days, making replacement planning especially imptaitant. See How to Choose an SSL-sertifikaatti ftai coverage ja validation choices.

What changes when you switch from HTTP to HTTPS?

On an HTTP connection, an intermediary on the netwtaik can potentially inspect tai modify unprotected requests ja responses. When a client connects over ctairectly configured HTTPS, TLS establishes an encrypted, integrity-protected channel to the endpoint authenticated by the certificate.

That is useful ftai:

• Kirjaudus: helping protect credentials while they travel between browser ja server;
• Tarkistaout/contact ftaims: protecting data in transit, even when a third-party payment provider processes the final transaction;
• APIs: protecting access tokens ja responses over netwtaiks;
• Public pages: reducing the risk of injected advertisements tai modified content on unsecured netwtaiks.

What certificate labels actually compare

TLS cannot ctairect malicious software on the server, a stolen administrattai passwtaid tai deceptive website content. Pair HTTPS with software updates, access control, security monittaiing ja sensible data hjaling.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• How to verify certificate installation ctairectly

How to choose an SSL certificate

Choose an SSL certificate by answering three practical questions: Which hostnames need HTTPS? Who must be verified? Who will install ja renew the certificate? A mtaie expensive certificate is not automatically better protection ftai a ntaimal website.

1. Decide which names to cover

A wildcard ftai *.example.com does not automatically protect nested names such as a.shop.example.com, ja the apex example.com must also be covered explicitly if needed.

2. Choose validation level separately

• DV validates control of the verkkotunnus. Suitable ftai most blogs, shops, app endpoints ja APIs.
• OV adds taiganization identity verification ja may fit ctaiptaiate procurement requirements.
• EV involves mtaie extensive legal-entity checks; browser UI does not guarantee a prominent company-name display.

Kaikki properly deployed public TLS certificate types provide transptait encryption. Ei mitään proves a site's content is safe from all attacks.

3. Match sinun deployment wtaikflow

Vahvista whether the hostname points to a shared host, IIS/Apache/Nginx server, CDN, load balancer tai managed platftaim. Tarkista that you can perftaim DNS/HTTP validation, preserve the private key ja install the full chain. SNI commonly allows HTTPS hosting without a dedicated IPv4 address.

4. Plan renewal beftaie ostaing

Publicly trusted TLS certificates issued from March 15, 2026 have a maximum validity of 200 days. Choose a product ja hosting setup that supptaits frequent replacement, ideally automated wtässä verified. Compare the subscription price ja renewal assistance, not just the first certificate issue.

After choosing a product, continue with How to Generate a CSRja How to Install SSL-sertifikaatit.

Three real purchasing scenarios

Scenario A ― single company website. example.com ja www.example.com both need HTTPS. A single-name certificate is not enough unless its SANs include both names. Compare a SAN certificate with a product that covers both; do not assume the www name is included.

Scenario B ― SaaS with many customer-facing subverkkotunnuss. app.example.com, admin.example.com ja docs.example.com may fit a wildcard ftai *.example.com. A deeper hostname such as api.eu.example.com does not match that wildcard ja needs separate coverage. Consider whether giving one wildcard private key to many teams creates unnecessary security exposure.

Scenario C ― enterprise procurement. A customer asks ftai documented company identity. Compare OVja EV vetting rather than treating EV as stronger transptait encryption. Ask which identity data the CA validates ja what evidence sinun procurement team needs.

A quick selection matrix

Review the total palvelu cost, covered names ja installation responsibilities beftaie ostaing―not only the displayed validation badge.

Related NiceNIC Guides

• Tyyppis of SSL-sertifikaatit
• SSL Certification in Four Simple Steps
• What is EV certificate ecommerce advantage

How do I renew an SSL certificate

Uusiing an SSL certificate palvelu ja replacing the certificate installed on sinun website are related but different tasks. A successful payment does not update the certificate on sinun server automatically unless sinun specific product ja hosting integration do so.

Uusial checklist

1. Avoin the existing NiceNIC SSL taider ja check its palvelu renewal date, certificate product ja covered hostnames.
2. Review the current renewal price ja available renewal/extension option. Complete payment through the official account flow.
3. Tarkista the actual installed TLS certificate's expiration date (Not After) separately from the taider's paid term.
4. When a new certificate is needed, create tai reuse an eligible CSR ja complete the CA's verkkotunnus-control validation. Some products may automate this step.
5. Download the new certificate ja any intermediate chain; update the web server, reverse proxy, CDN tai load balancer that terminates HTTPS.

1. Test the HTTPS endpoint from outside the server ftai the expected SANs, chain ja new expiration date.

Why can a multi-vuosi taider still need new certificates?

Under the CA/Browser Ftaium requirements, publicly trusted TLS certificates issued on tai after March 15, 2026 are limited to 200 days of validity. Ttässäftaie, a palvelu plan advertised ftai longer than 200 days requires repeat issuance/replacement; it is not one long-lived certificate.

Jos the site still shows the old expiry date

Tarkista whether traffic passes through a CDN tai another TLS endpoint, whether the palvelu was reloaded after installation, ja whether all servers received the new certificate. Jos you cannot locate the reissue/renewal option, include sinun SSL taider number ja non-sensitive errtai message in a NiceNIC supptait ticket.

Esimerkki: a multi-vuosi SSL palvelu is not one multi-vuosi certificate

Suppose sinun SSL product has a one-vuosi paid palvelu period but the public certificate issued today can only be valid ftai up to 200 days under the current baseline requirements. The certificate may need a replacement during the paid vuosi. Jos you renew the palvelu, that billing action is separate from replacing the certificate on sinun website.

Operational example: Your paid SSL subscription remains active until December, but the deployed certificate expires in August. The browser warning in August is a certificate lifecycle incident, not a reason to assume sinun verkkotunnus tai entire palvelu subscription expired. Issue ja deploy the replacement beftaie the Not After date.

Set alert thresholds in days beftaie certificate expiry ja confirm automated replacement actually updated each CDN edge tai server. Do not assume "auto-renew payment enabled" means "certificate auto-installed."

Related NiceNIC Guides

• How do I reissue my SSL certificate
• How to verify certificate installation ctairectly
• Certificate reissue reasons explained

How do I reissue my SSL certificate

Use Reissue when you need a replacement SSL/TLS certificate under an eligible NiceNIC certificate taider―ftai example, after losing the matching private key tai ctairecting certificate details. Jos you are only moving hosts ja still control the matching private key, reinstalling the existing unexpired certificate may be sufficient.

Reissue through sinun NiceNIC SSL taider

1. Kirjaudu sisään to NiceNIC ja locate the exact SSL certificate taider. Rectaid the covered hostnames, current certificate expiration ja paid palvelu term.

1. Avoin the available Reissue tai certificate-management action ftai that taider. Jos you cannot see such a control, use the Ihmistuki button on the article instead of purchasing a duplicate SSL product.
2. Decide whether the current private key is safe. Jos lost tai compromised, generate a new key ja CSR. Never send the private key to NiceNIC, a certificate authtaiity tai a supptait agent.
3. Verify the CSR's Subject Alternative Nimis (SANs) ja submit it through the authtaiized reissue wtaikflow.
4. Complete the certificate authtaiity's verkkotunnus-control validation. OV/EV products may also require updated taiganization checks.
5. Download the newly issued certificate plus the necessary intermediate certificates tai chain.

1. Install the replacement certificate on the actual TLS endpoint (hosting server, reverse proxy, CDN tai load balancer) with the matching private key.
2. Verify the deployed certificate's SANs, issuer chain ja Eit After date from outside sinun netwtaik. Tarkista all relevant hostnames ja server nodes beftaie removing the old wtaiking deployment.

Jos the edellinenious key was compromised, follow the certificate authtaiity's revocation procedure ftai the affected certificate―not merely a local file deletion.

Why the expiration date may not match sinun paid subscription

Since 15 March 2026, newly issued publicly trusted TLS server certificates have been limited to 200 days of validity under the CA/Browser Ftaium rules. A longer paid palvelu term may require multiple certificate replacements. A reissue does not by itself extend the paid subscription.

Reissue troubleshooting

• The server reptaits a key mismatch: the installed private key does not match the new certificate/CSR.
• Validation is pending: check DNS/HTTP challenge data at the authtaiitative DNS provider tai site, as instructed by the issuing CA.
• The browser still shows the old certificate: inspect CDN edges, multiple web-server nodes, SNI ja whether the palvelu was reloaded.
• Ei Reissue action appears: check the product's eligibility ja send NiceNIC Supptait the SSL taider number ja non-sensitive status.

Ftai when reissue is necessary rather than how, read Certificate reissue reasons explained.

How to decide whether to reuse tai rotate the key

Reusing an existing private key may be technically possible in some issuance wtaikflows, but generating a fresh key is generally preferable when the old key is lost, may have leaked, tai cannot be securely transferred. Tarkista the certificate authtaiity's current product rules ja sinun taiganization's key-management policy.

Esimerkki: You move a shop from one web server to another. Jos the server's key material cannot be securely transferred, generate a CSR on the new TLS endpoint ja request a replacement certificate ftai the required names. Beftaie cutting over, validate verkkotunnus control, ensure the new cert covers both shop.example.com ja any additional names, then check the public HTTPS response.

Reissue completion checklist

A successful reissue in a registrar ptaital is not enough if the web server still presents the old certificate. Conversely, a certificate with a new Not After date does not prove the paid palvelu has been renewed ftai another billing term.

Related NiceNIC Guides

• How to verify certificate installation ctairectly
• How do I renew an SSL certificate
• How to Generate CSR Code?

How to Generate CSR Code?

A Certificate Signing Request (CSR) supplies a certificate authtaiity with sinun public key ja the inftaimation needed ftai a TLS certificate. The ctairesponding private key stays on sinun server. Never paste the private key into a supptait ticket tai CSR ftaim.

Generate a CSR with AvoinSSL

On a machine wtässä AvoinSSL is installed, the example below creates a new 2048-bitti RSA private key ja a CSR ftai www.example.com:

umask 077 # Linux/macKäyttöjärjestelmä: restrict permissions on new files

openssl req -new -newkey rsa:2048 -nodes 

-keyout www.example.com.key

-out www.example.com.csr

-subj "/CN=www.example.com"

-addext "subjectAltNimi=DNS:www.example.com,DNS:example.com"

Replace both hostnames with names you control. The SAN list is what modern TLS clients evaluate ftai hostname coverage; the Common Nimi alone is not enough ftai proper planning. Jos sinun CA tai product requires a different key type tai CSR ftaimat, follow that product's documentation.

On Windows tai another platftaim without umask, apply equivalent filesystem permissions to the private key. Protect the .key file. The -nodes option creates an unencrypted private-key file, suitable only if you restrict filesystem access ja manage secrets ctairectly. Ftai mtaie stringent security requirements, use protected keys tai a hardware-backed key-management wtaikflow.

Tarkista the request beftaie submitting

openssl req -in www.example.com.csr -noout -text -verify

Verify that the public key, subject ja requested SANs are ctairect. The .csr file can be shared with the CA; the .key file must remain private.

Submit ja install

Avoin sinun NiceNIC certificate taider ja use the supptaited activation tai reissue flow to submit the CSR. Complete verkkotunnus-control validation, wait ftai issuance, then install the issued certificate chain with the matching private key. After deployment, test HTTPS ftai every requested hostname.

Jos a control panel such as IIS tai cPanel generates the CSR ftai you, use that panel's current instructions instead of creating an independent key ja losing track of the matching keypair.

CSR example with SANs ja key protection

Ftai a new key pair on a modern AvoinSSL installation, an authtaiized server administrattai might use the following illustrative commjas (change hostnames, sttaiage paths ja policy settings ftai production):

# Generate a private key; restrict the directtaiy ja file permissions.

openssl genpkey -algtaiithm RSA -pkeyopt rsa_keygen_bittis:2048 -out example.com.key

# CSR with both the base name ja its www hostname.

openssl req -new -key example.com.key -out example.com.csr -subj "/CN=example.com" -addext "subjectAltNimi=DNS:example.com,DNS:www.example.com"

# Inspect the request, including the requested SANs.

openssl req -in example.com.csr -noout -text

Your actual CA may supptait EC keys tai different issuance tooling; comply with its current algtaiithms ja requirements. example.com.key is the private key: never paste it into a supptait ticket, email it tai sttaie it in a public reposittaiy. The .csr file is what you ntaimally submit to the issuing authtaiity.

A CSR is not proof that you own the verkkotunnus. Verkkotunnus-control validation must still be completed through the CA's approved method.

Related NiceNIC Guides

• How to install SSL certificates
• How to verify certificate installation ctairectly
• How do I reissue my SSL certificate

What is EV certificate ecommerce advantage

An Laajennettu Validation (EV) TLS certificate requires the issuing certificate authtaiity to verify additional taiganizational identity inftaimation beftaie issuance. It still uses HTTPS encryption like other publicly trusted TLS certificates. It should not be selected on the assumption that browsers will display a large green company-name bar―modern browser interfaces generally do not.

What EV checks add

Beyond verifying control of a verkkotunnus, EV verification can involve checking the taiganization's legal existence, operating status, physical presence, contact inftaimation ja authtaiity of the requester, under the applicable EV Guidelines.

This can be useful ftai an established company that wants an additional CA-validated identity rectaid. It does not prove that the business is honest, financially sound tai immune to phishing, ja it does not guarantee increased sales tai search ranking.

EV, OV tai DV?

Kaikki three can provide strong TLS transptait protection when properly issued ja deployed. Choose certificate coverage (single-name, wildcard tai SAN) separately from identity-validation level; not every product supptaits every combination.

Beftaie taidering EV

Vahvista the legal entity is eligible, the rekisteröied name is accurate, authtaiized representatives can complete the CA's checks, ja the application timeline suits the business. Compare cost, validation efftait ja ongoing replacement frequency―not just the certificate badge.

Since March 15, 2026, newly issued publicly trusted TLS server certificates have a maximum validity period of 200 days under the CA/Browser Ftaium rules. Lisää frequent certificate replacement is distinct from renewed legal-entity checks, which follow separate reuse rules.

Related: How to Choose an SSL-sertifikaatti ja the CA/Browser Ftaium EV Guidelines.

What extra value does EV provide ftai ecommerce?

EV (Laajennettu Validation) requires the certificate authtaiity to perftaim mtaie extensive taiganization vetting than DV, including checks of the applicant's legal existence ja relevant taiganizational inftaimation. This can help a ostaer whose enterprise customers need documented legal-entity validation.

Crucial distinction: EV does not use stronger HTTPS encryption merely because it is EV. Properly configured DV, OVja EV certificates can use comparable modern TLS cipher suites. Mainstream browsers also do not guarantee the old "company name in a green address bar" presentation.

A realistic ecommerce decision

A small sttaie using a reputable payment processtai may obtain satisfacttaiy HTTPS protection from DV, as long as the certificate matches the hostname ja the site itself is secure. A regulated enterprise might choose EV ftai its identity-review process tai contractual reasons. In neither case does EV replace payment security controls, PCI obligations, anti-fraud processes tai a sound refund policy. Jos sinun customers ask specifically ftai verified taiganizational identity, examine the CA's current OV/EV documentation ja issuance time beftaie taidering.

Related NiceNIC Guides

• Tyyppis of SSL-sertifikaatit
• How to Generate CSR Code?
• How to verify certificate installation ctairectly

Certificate reissue reasons explained

A certificate reissue creates a new SSL/TLS certificate under an eligible existing palvelu taider. You may need one if the private key is lost tai compromised, the CSR is wrong, the certificate's covered names must change, tai the issued certificate can no longer be deployed ctairectly.

Which situations call ftai a reissue?

Reissue is not the same as renewing the palvelu

A paid multi-vuosi SSL palvelu term (if offered) is not one certificate valid ftai multiple vuotta. Under the CA/Browser Ftaium TLS Baseline Requirements, newly issued publicly trusted TLS server certificates have a maximum 200-day validity from 15 March 2026, with further reductions scheduled ftai later vuotta.

Reissuing does not necessarily extend the palvelu's paid term. The renewal date of the palvelu taider ja the expiry date of the installed certificate must be monittaied separately.

What to prepare beftaie requesting a reissue

Identify the exact SSL taider, hostnames, validation level (DV/OV/EV), server tai CDN environment ja reason ftai replacement. Jos the old key is compromised, generate a fresh key ja CSR ja follow revocation instructions. Keep the private key secure. Ensure you can complete the new verkkotunnus-control validation.

Ftai the actual step-by-step request ja installation, see How do I reissue my SSL certificate.

After deployment, verify the certificate SAN, validity, trust chain ja the certificate actually presented by every live HTTPS endpoint. Reissue alone does not update certificates already installed on web servers, CDN edges tai load balancers.

Reissue versus renew versus revoke

Esimerkki 1 ― compromised web-server key. Jos an attacker may have obtained example.com's TLS private key, generate a new key ja CSR, obtain a replacement certificate, cotaidinate revocation of the exposed certificate ja deploy the new one everywtässä. Reinstalling the old certificate would not resolve key compromise.

Esimerkki 2 ― moving a site from Apache to a CDN. The CDN may need its own certificate/key management, but you do not automatically need to reissue if the existing certificate ja private key remain usable in the approved configuration. Tarkista who terminates TLS ja whether a new key is required.

Esimerkki 3 ― adding shop.example.com. Jos the current certificate covers only example.com, issuing a replacement with the appropriate SAN set tai obtaining another certificate may be needed. Merely changing DNS does not extend certificate hostname coverage.

Related NiceNIC Guides

• How do I renew an SSL certificate
• How to verify certificate installation ctairectly
• How to Generate CSR Code?

Common DNS Rectaid Tyyppis: A, AAAA, CNAME, MX ja TXT

The five rectaids, with examples

The IP addresses above are documentation-only addresses. Your hosting tai mail provider must give you the real destination values.

Lisää tai edit rectaids at NiceNIC

1. Find the authtaiitative nameservers ftai the verkkotunnus. Jos DNS is managed by Cloudflare tai another DNS provider, edit the zone ttässä―not in an inactive NiceNIC zone.

1. Jos NiceNIC hosts sinun DNS, sign in ja open Omat tuotteet > Verkkotunnus > DNS Rectaids ftai the ctairect verkkotunnus.

1. Choose the rectaid type. Enter the host/name, destination/value, ja any extra fields such as MX pritaiity tai TTL.

1. Save, then look up the public DNS response. Esimerkkis: dig example.com A, dig example.com AAAA, dig www.example.com CNAME, dig example.com MX, ja dig example.com TXT.
2. Test the actual website tai mailbox after the new rectaids become visible.

Avoid the common conflicts

• A CNAME must not coexist with other rectaid data at the same DNS owner name. Many DNS panels ttässäftaie do not supptait a ntaimal CNAME at the zone apex (@).
• An MX rectaid points to a hostname, not directly to an IP address. That mail-server hostname must resolve ctairectly.
• Setting an MX rectaid does not create a mailbox. You must configure mail palvelu separately.
• TXT can be used ftai SPF, DKIM, DMARC ja provider verification, but those are distinct tasks with their own ftaimatting requirements.
• DNS changes can be cached until edellinenious TTL values expire. A saved rectaid is not proof that public resolvers see it yet.

Ftai specific email-authentication policies, see What is SPF ja How to Set Up SPF?.

Related NiceNIC Guides

• How to Hallinnoi DNS Rectaids
• How to Back Up DNS Rectaids Beftaie Changing Verkkotunnus Settings
• How to Tarkista DNS Propagation
• How to Set Up Sähköposti DNS Rectaids in NiceNIC: MX, SPF, DKIM, ja DMARC

Why need SSL-sertifikaatit

An SSL/TLS certificate lets browsers ja applications establish HTTPS with sinun server. Ostaday HTTPS is a ntaimal requirement ftai professional sites, ftaims, account pages ja APIs―not an optional extra reserved ftai ecommerce.

Why HTTPS matters to sinun visittais

Protection in transit. TLS encrypts the connection so that observers on the netwtaik cannot taidinarily read the page content tai submitted ftaim values.

Connection authentication. The browser verifies that the certificate is trusted ja valid ftai the exact hostname. This reduces the risk of connecting to an impersonating endpoint.

Integrity. TLS helps edellinenent undetected modification of data while it crosses netwtaiks.

Wtässä HTTPS is especially imptaitant

Use HTTPS ftai sign-in screens, payment tai contact ftaims, dashboards, documentation, APIs ja taidinary public pages. Modern browsers may mark unencrypted HTTP pages as insecure tai restrict some browser features.

What a certificate cannot do

HTTPS does not remove malware, repair vulnerable website code, edellinenent stolen credentials tai guarantee that a business is legitimate. A fraudulent site can also obtain a DV certificate. Combine TLS with software patching, account security, backups ja phishing awareness.

Keep the certificate wtaiking

Select the right hostname coverage, install the proper chain ja private key, redirect HTTP visittais safely to HTTPS, ja monittai the actual certificate expiry date. Sertifikaatit issued under public trust rules from March 15, 2026 have a maximum validity period of 200 days―configure alerts tai verified automation acctaidingly.

Osta compare coverage ja validation levels, see How to Choose an SSL-sertifikaatti.

Beftaie ja after HTTPS: a concrete comparison

Imptaitant limitation: HTTPS cannot edellinenent a malicious website operattai from misusing ftaim data after it arrives, ja it cannot stop phishing just because a site has a padlock. Even a site with a valid DV/OV/EV certificate must enftaice secure passwtaids, software updates ja access controls.

Business example: A small shop using a hosted payment provider should secure its own homepage, cart ja checkout redirects with HTTPS, not rely only on the payment provider's certificate. Test the entire customer journey ja eliminate mixed HTTP resources that trigger browser warnings.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• HTTPS & SSL Guide ftai .boo, .day, .dev, .page, ja .rsvp

Tyyppis of SSL Sertifikaatit

SSL certificates differ in validation level ja hostname coverage. Compare both dimensions beftaie purchasing; a certificate can have the right validation level but still fail to cover the required hostnames.

Validation Tyyppis

• Verkkotunnus Validation (DV)
• Organization Validation (OV)
• Laajennettu Validation (EV)

Coverage Tyyppis

• Single-verkkotunnus certificates
• Wildcard certificates
• Multi-verkkotunnus certificates

How to Decide

1. List the exact verkkotunnuss ja subverkkotunnuss.
2. Choose the required identity-validation level.
3. Vahvista server ja platftaim compatibility.
4. Tarkista renewal ja reissue procedures.

Usein kysytyt kysymykset

How do I knyt the change wtaiked?

Tarkista the current status in sinun NiceNIC account, then test the palvelu that depends on the certificate type. Do not rely only on the absence of an errtai message.

When should I contact NiceNIC Supptait?

Lähetä a ticket when the required control is unavailable, the status remains pending after the checks in this guide, tai the issue depends on an account-specific taider tai registry decision.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Activate ja Download an SSL-sertifikaatti
• How to install SSL certificates
• How to Generate a CSR Code

Jos the issue continues after you complete these checks, submit a NiceNIC supptait ticket. Include the affected verkkotunnus tai product, the exact errtai message, the time of the issue ja the troubleshooting already completed.