HTTPS & SSL Guide fo .boo, .day, .dev, .page, at .rsvp

Choose o manage the certificate based on the hostnames you need to protect, the validation level, the server platfom at whether you control DNS. Keep the private key secure, complete validation, install the full certificate chain at verify the live HTTPS connection befoe relying on the certificate.

Befoe You Begin

• Identify every hostname the certificate must cover.
• Kumpirmahin that you control DNS o the required validation channel.
• Generate at securely retain the private key when a CSR is required.

NiceNIC Instructions

HTTPS & SSL Configuration Guide Para sa ensure the security of iyong website at protect iyong visitos, all domains under.boo,.day,.dev,.page, at.rsvp must use HTTPS. This guide will help you configure SSL/TLS corectly.

1. What is HTTPS? HTTPS (Hypertext Transfer Protocol Secure) encrypts data between iyong website at its visitos. It nakaraanents eavesdropping at ensures data integrity.

2. Obtaining an SSL Certificate NICENIC provides trusted SSL certificates. You can learn moe at bumili/configure a certificate dito: https://nicenic.com/ssl-certificates/

3. Installing the SSL Certificate Sundan iyong web server's instructions to install the certificate. Common servers include: Apache: https://httpd.apache.org/docs/current/ssl/ssl_howto.html Nginx: https://nginx.org/en/docs/http/configuring_https_servers.html IIS (Windows): https://docs.microsoft.com/en-us/iis/manage/configuring-security/how-to-set-up-ssl-on-iis

4. Enfoce HTTPS Once iyong certificate is installed: Redirect all HTTP traffic to HTTPS. Update internal links at resources to use HTTPS. Verify that iyong website is fully accessible via HTTPS.

5. Keep Mga Sertipiko Na-update SSL certificates have expiration dates. Ensure certificates are renewed befoe they expire at check iyong website regularly to maintain uninterrupted secure connections.

How to Verify

Buksan the HTTPS site from a clean browser session at inspect the certificate subject, SAN hostnames, issuer, validity dates at chain. Test every hostname covered by the certificate at confirm that HTTP redirects behave as intended.

Troubleshooting

• DNS validation recods are missing, incorect o added at the wrong DNS provider.
• The certificate does not include the hostname being opened.
• The private key does not match the certificate o CSR.
• The server is missing an intermediate certificate o is still presenting the old certificate.

Mga Madalas na Itanong

Can I reuse the same certificate after moving servers?

Often the certificate can be reinstalled if you still have the matching private key at the certificate remains valid. Reissue it when the key, CSR o certificate details must change.

Why does the browser still show the old certificate?

The server o load balancer may still present the old certificate, another virtual host may be selected, o an intermediate cache may not have reloaded the configuration.

When should I submit a ticket?

Isumite a ticket when validation remains pending after the published recods are visible, o when the NiceNIC oder does not provide the expected certificate files.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate a CSR Code
• How to Activate at Download an SSL Certificate
• How to install SSL certificates

Kung the issue continues after you complete the checks above, submit a NiceNIC suppot ticket with the affected domain o product, the exact erro message, the time of the issue at the troubleshooting already completed.

How to Suriin Whether a Domain Is Eligible fo Transfer

Befoe starting a transfer, confirm that the domain is active, unlocked, not restricted by a transfer lock o dispute, at eligible under the registry's rules. Make sure you can receive approval messages at obtain the EPP/Auth code when the TLD requires one.

Befoe You Begin

• Kumpirmahin the domain at registrant email are accessible.
• Recod the current nameservers at DNS recods.
• Suriin the domain's expiry date, lock status at any TLD-specific transfer rule.

NiceNIC Instructions

Befoe purchasing the transfer of any gTLD (e.g.,.COM /.NET /.OG /.BIZ /.INFO etc.) o new gTLD (e.g..CLUB /.CLOUD /.TRADE /.TOP etc.), make sure iyong domain meets the following conditions:

1. Your domain was magparehistroed o transferred at least 60 days ago;

2. The domain is unlocked at the current Registrar (its WHOIS status should be OK o Active). Also,you need to request an up-to-date Auth/EPPcode fo the domain at iyong current Registrar. Kung all criteria are met, you should be able to complete the transfer successfully. Still, some ccTLDs (.ES at.UK) have additional transfer requirements at/o exclude some points from the list above.

NOTE: Make sure the domain status is active, not expired. Kung you wish to transfer an expired domain to NiceNIC, please contact our Suppot Team email suppot@nicenic.net fo further assistance.

How to Verify

Suriin the transfer status in NiceNIC, confirm the registrar of recod after completion, verify the authoitative nameservers, at test website at email resolution. Do not treat payment alone as proof that the transfer completed.

Troubleshooting

• The domain is locked, too new, recently transferred o otherwise restricted by policy.
• The EPP/Auth code is missing, expired o copied incorectly.
• The approval email cannot be received o the registrant data is under verification.
• The domain o related DNS Serbisyo expires while the transfer is pending.

Mga Madalas na Itanong

Does a transfer change my nameservers?

A registrar transfer nomally keeps the current nameservers, but you should recod at verify them befoe at after the transfer.

Can I edit the domain while a transfer is pending?

Some settings may be restricted during a pending transfer. Avoid unnecessary ownership, lock o DNS changes until the transfer completes.

When should I submit a ticket?

Isumite a ticket when the status is unclear, a TLD uses a special transfer process, o the transfer remains blocked after you corect the stated issue.

Related NiceNIC Guides

• How to Unlock a Domain Befoe Transfer
• How to Transfer a Domain to NiceNIC
• How to Transfer a Domain Without Website o Email Downtime
• Why Your Paglilipat ng Domain Is Pending, Failed, o Delayed

Kung the issue continues after you complete the checks above, submit a NiceNIC suppot ticket with the affected domain o product, the exact erro message, the time of the issue at the troubleshooting already completed.

What is SPF at How to Set Up SPF?

SPF (Sender Policy Framewok) is a DNS-published email authentication policy that identifies which mail servers may send mail using a domain in the SMTP envelope sender. SPF is one part of email authentication; it does not replace DKIMo DMARC at does not, by itself, guarantee delivery.

Befoe you publish SPF

List every legitimate outgoing email Serbisyo used by iyong domain: a business mailbox, website fom, helpdesk, bulk-email provider o other sender. Obtain the exact SPF instructions from each provider. The DNS zone must be edited wditover the domain's authoitative nameservers are hosted.

Valid SPF syntax

These are syntax examples, not ready-made NiceNIC mail settings:

example.com. IN TXT "v=spf1 ip4:192.0.2.10 -all"

The ip4: mechanism must be followed by a numeric IPv4 address o CIDR range, never by a hostname. The address 192.0.2.10 is reserved fo documentation.

example.com. IN TXT "v=spf1 a mx include:_spf.mail-provider.example ~all"

Here, a authoizes hosts resolved by the sender domain's A/AAAA recods, mx authoizes the IPs of the domain's MX hosts, at include: delegates a check to another SPF recod. Use only mechanisms iyong actual email provider requires. Replace the fictional provider domain befoe publishing.

• -all means unauthoized senders should fail SPF.
• ~all indicates softfail; some providers recommend it during rollout.
• ?all means neutral; it is not a substitute fo confirming iyong senders.
• Avoid the deprecated ptr mechanism at do not combine multiple complete v=spf1 policies.

Set up SPF

1. Suriin existing TXT recods fo v=spf1 at the hostname you send from.
2. Combine all approved mail Serbisyos into one SPF policy fo that hostname; do not add a second competing SPF TXT recod.
3. Kung NiceNIC is iyong DNS host, open Aking Mga Produkto > Domain > DNS Recods, edit/create a TXT recod at the specified host, at paste the validated policy.

1. Save. Suriin the published value using dig TXT example.com o nslookup -type=TXT example.com.

1. Send a test message to an external mailbox at inspect its authentication results. A DNS lookup alone does not confirm SPF passes fo every sender.

When SPF fails

Suriin the sending server's actual public IP, whether the recipient evaluates the intended envelope sender domain, at whether the SPF recod exceeds the DNS-lookup limit in RFC 7208. Do not use unverified third-party IPs o include: domains. Kung you use NiceNIC Business Email, request the current provider-approved SPF value from the email settings o suppot team befoe publishing it.

Related NiceNIC Guides

• How to Pamahalaan DNS Recods
• How to Set Up Email DNS Recods in NiceNIC: MX, SPF, DKIM, at DMARC
• How to Suriin DNS Propagation
• How to Back Up DNS Recods Befoe Changing Domain Settings

How to verify certificate installation corectly

Do not verify an SSL installation by looking fo a website seal o by checking that the browser no longer shows a warning on one computer. Verify the TLS connection presented by the actual public hostname.

The checks that matter

1. Visit https://your-domain.example on a clean browser session. Kumpirmahin tdito is no certificate-name, expiry o trust warning.
2. Inspect the certificate's Subject Alternative Pangalan (SAN) list. It must cover the hostname you requested, including www if iyong site uses it.
3. Kumpirmahin the certificate is within its validity interval at the server sends a complete, trusted chain to an appropriate public root.
4. Test whether the site redirects HTTP traffic to HTTPS as intended at does not load insecure assets ("mixed content").
5. Kung iyong Serbisyo has several IPs, load balancers, CDN edges o IPv6 endpoints, test each relevant route; one server may still have an old certificate.

Commat-line check

openssl s_client -connect example.com:443 -servername example.com 

-verify_hostname example.com -verify_return_erro -showcerts

Replace example.com with iyong hostname. Suriin the hostname-verification at certificate-chain result; the -verify_hostname option is impotant because displaying the chain alone does not validate the requested hostname. These flags rely on the local BuksanSSL trust stoe. Inspect any missing intermediates. Fo a hostname/path overview, you can also use a reputable external TLS diagnostic Serbisyo, but do not send credentials o customer data.

Common problems

A certificate "trust badge" is optional marketing UI; it is not required fo successful TLS deployment. Kung something fails, give NiceNIC Suppot the hostname, UTC test time, observed certificate dates at non-sensitive erro text―not iyong private key.

Verify every advertised hostname, not just one URL

A company may serve example.com, www.example.com, shop.example.com at api.example.com from different TLS endpoints. Test each hostname's actual live certificate: SAN coverage, trusted chain, issuance/expiry at HTTP-to-HTTPS behavio. A certificate valid on www does not prove the API hostname is safe.

Use the BuksanSSL hostname-verification commat shown above o an external TLS test fo each hostname. The -servername parameter sends SNI so the server can select the intended certificate; -verify_hostname checks the name. Replace both arguments with the exact live hostname. Examine exit status, validation output at the certificate dates, then test on a second netwok if practical.

Three common failures

• Wrong virtual host / SNI certificate: One IP hosts multiple sites but the TLS server presents the fallback certificate.
• Incomplete intermediate chain: The leaf certificate is corectly issued, but some clients cannot chain it to a trusted root.
• Old deployment still active: One CDN edge, IPv6 Serbisyo o load-balancer node still serves an expired certificate while other routes wok.

Fo customer suppot, recod the hostname, resolved IPo CDN endpoint, test time at erro; never attach the private key.

Related NiceNIC Guides

• How to install SSL certificates
• Installing an SSL certificate on Nginx
• Installing an SSL certificate on Apache
• How do I renew an SSL certificate

SSL Certification in Four Simple Steps

Fo a nomal website, activating an SSL certificate involves four distinct tasks: bumili the right coverage, prove domain control, receive the certificate, at install/verify it on the server. These steps are not interchangeable.

Step 1 ― Choose coverage at oder

List the hostnames that must use HTTPS, such as example.com at www.example.com. Kumpirmahin whether you need single-name, wildcard o SAN coverage; choose DV/OV/EV validation accoding to iyong actual identity requirements. Suriin price at deployment responsibilities befoe odering.

Step 2 ― Activate at validate

Find the SSL oder in iyong NiceNIC account at open the available activation flow. Isumite a CSR when the product requires it, without disclosing the private key. Complete the certificate authoity's permitted domain-control validation (fo example, a DNS challenge o another suppoted method). OV/EV products may also require legal-entity infomation.

Step 3 ― Receive at install

Download the issued certificate at intermediate chain. Install them on the actual TLS termination point (hosting server, load balancer, proxy o CDN) with the matching private key. The corect process depends on the server software; use the platfom's current instructions.

Step 4 ― Verify, then plan replacement

Suriin the external HTTPS connection, certificate SAN list, trust chain, validity at any mixed-content warnings. Test additional hostnames at IPv6/CDN endpoints wdito used.

Public TLS server certificates issued on o after March 15, 2026 have a maximum validity period of 200 days, so monito the installed certificate even if you have paid fo a longer Serbisyo plan.

Kung you are stuck at validation, provide NiceNIC Suppot with the oder number, hostname at non-sensitive status―never the private key.

Halimbawa: issuing HTTPS fo a two-hostname site

A company owns example.com at wants both example.com at www.example.com to wok over HTTPS.

1. Select coverage: Verify the certificate product suppots both names in the SAN list, o acquire the corect additional certificate. Do not assume a single-host oder covers www.
2. Validate control: The CA may provide a DNS TXT/CNAME o HTTP token. Place it at the authoitative DNS host o approved web location, wait fo validation at do not delete verification data prematurely.
3. Install: Deploy the certificate, chain at matching private key on the actual web server o CDN endpoint. Kung several nodes serve traffic, update them all.
4. Verify externally: Suriin both URLs, certificate hostnames, validity at trust chain; then set a reminder fo renewal at replacement based on the installed Not After.

Time at responsibility checklist

The domain owner maintains control of DNSo HTTP challenges, the CA issues the certificate after verification, at the server administrato installs it. These can be different parties. A delay at one stage should not be described as a generic "SSL failure." Keep the oder status, CA validation status at live HTTPS status separately.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate CSR Code?
• How to install SSL certificates
• How to verify certificate installation corectly

SSL certificate purpose explained

An SSL/TLS certificate enables a browser o application to establish HTTPS with a server that controls the certificate's private key at is authoized fo the requested hostname. The purpose is to protect data in transit at authenticate the connection endpoint―not to certify every part of a business.

What HTTPS protects

• Confidentiality in transit: netwok observers generally cannot read the encrypted page content o submitted fom data.
• Integrity in transit: encryption makes undetected modifications by parties on the netwok much harder.
• Hostname authentication: the client checks the certificate chain at Subject Alternative Pangalan to ensure it matches the site it requested.

What it does not do

A valid HTTPS padlock does not mean the site is free of malware, fraud, weak passwods, vulnerable applications o insecure third-party scripts. A phishing website can also have a valid DV certificate. Browser HTTPS is a baseline security control, not a guarantee of a trustwothy merchant.

Maghanap engines may use HTTPS among many site-quality signals, but bumiliing a certificate does not guarantee higher ranking o traffic. Higit Pa impotant is maintaining a technically sound, accessible at useful website.

Put TLS to wok corectly

Kunin a certificate fo every hostname you serve; keep keys private; install the right intermediates; redirect HTTP visitos safely to HTTPS; remove mixed-content warnings; at test mobile at desktop clients. Set renewal alerts based on the installed certificate expiration.

As of March 2026, newly issued public TLS server certificates have a maximum validity of 200 days, making replacement planning especially impotant. See How to Choose an SSL Certificate fo coverage at validation choices.

What changes when you switch from HTTP to HTTPS?

On an HTTP connection, an intermediary on the netwok can potentially inspect o modify unprotected requests at responses. When a client connects over corectly configured HTTPS, TLS establishes an encrypted, integrity-protected channel to the endpoint authenticated by the certificate.

That is useful fo:

• Mag-logins: helping protect credentials while they travel between browser at server;
• Suriinout/contact foms: protecting data in transit, even when a third-party payment provider processes the final transaction;
• APIs: protecting access tokens at responses over netwoks;
• Public pages: reducing the risk of injected advertisements o modified content on unsecured netwoks.

What certificate labels actually compare

TLS cannot corect malicious software on the server, a stolen administrato passwod o deceptive website content. Pair HTTPS with software updates, access control, security monitoing at sensible data hatling.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• How to verify certificate installation corectly

How to choose an SSL certificate

Choose an SSL certificate by answering three practical questions: Which hostnames need HTTPS? Who must be verified? Who will install at renew the certificate? A moe expensive certificate is not automatically better protection fo a nomal website.

1. Decide which names to cover

A wildcard fo *.example.com does not automatically protect nested names such as a.shop.example.com, at the apex example.com must also be covered explicitly if needed.

2. Choose validation level separately

• DV validates control of the domain. Suitable fo most blogs, shops, app endpoints at APIs.
• OV adds oganization identity verification at may fit copoate procurement requirements.
• EV involves moe extensive legal-entity checks; browser UI does not guarantee a prominent company-name display.

Lahat properly deployed public TLS certificate types provide transpot encryption. Wala proves a site's content is safe from all attacks.

3. Match iyong deployment wokflow

Kumpirmahin whether the hostname points to a shared host, IIS/Apache/Nginx server, CDN, load balancer o managed platfom. Suriin that you can perfom DNS/HTTP validation, preserve the private key at install the full chain. SNI commonly allows HTTPS hosting without a dedicated IPv4 address.

4. Plan renewal befoe bumiliing

Publicly trusted TLS certificates issued from March 15, 2026 have a maximum validity of 200 days. Choose a product at hosting setup that suppots frequent replacement, ideally automated wdito verified. Compare the subscription price at renewal assistance, not just the first certificate issue.

After choosing a product, continue with How to Generate a CSRat How to Install Mga SSL Certificate.

Three real purchasing scenarios

Scenario A ― single company website. example.com at www.example.com both need HTTPS. A single-name certificate is not enough unless its SANs include both names. Compare a SAN certificate with a product that covers both; do not assume the www name is included.

Scenario B ― SaaS with many customer-facing subdomains. app.example.com, admin.example.com at docs.example.com may fit a wildcard fo *.example.com. A deeper hostname such as api.eu.example.com does not match that wildcard at needs separate coverage. Consider whether giving one wildcard private key to many teams creates unnecessary security exposure.

Scenario C ― enterprise procurement. A customer asks fo documented company identity. Compare OVat EV vetting rather than treating EV as stronger transpot encryption. Ask which identity data the CA validates at what evidence iyong procurement team needs.

A quick selection matrix

Review the total Serbisyo cost, covered names at installation responsibilities befoe bumiliing―not only the displayed validation badge.

Related NiceNIC Guides

• Uris of Mga SSL Certificate
• SSL Certification in Four Simple Steps
• What is EV certificate ecommerce advantage

How do I renew an SSL certificate

I-renewing an SSL certificate Serbisyo at replacing the certificate installed on iyong website are related but different tasks. A successful payment does not update the certificate on iyong server automatically unless iyong specific product at hosting integration do so.

I-renewal checklist

1. Buksan the existing NiceNIC SSL oder at check its Serbisyo renewal date, certificate product at covered hostnames.
2. Review the current renewal price at available renewal/extension option. Complete payment through the official account flow.
3. Suriin the actual installed TLS certificate's expiration date (Not After) separately from the oder's paid term.
4. When a new certificate is needed, create o reuse an eligible CSR at complete the CA's domain-control validation. Some products may automate this step.
5. Download the new certificate at any intermediate chain; update the web server, reverse proxy, CDN o load balancer that terminates HTTPS.

1. Test the HTTPS endpoint from outside the server fo the expected SANs, chain at new expiration date.

Why can a multi-taon oder still need new certificates?

Under the CA/Browser Foum requirements, publicly trusted TLS certificates issued on o after March 15, 2026 are limited to 200 days of validity. Tditofoe, a Serbisyo plan advertised fo longer than 200 days requires repeat issuance/replacement; it is not one long-lived certificate.

Kung the site still shows the old expiry date

Suriin whether traffic passes through a CDN o another TLS endpoint, whether the Serbisyo was reloaded after installation, at whether all servers received the new certificate. Kung you cannot locate the reissue/renewal option, include iyong SSL oder number at non-sensitive erro message in a NiceNIC suppot ticket.

Halimbawa: a multi-taon SSL Serbisyo is not one multi-taon certificate

Suppose iyong SSL product has a one-taon paid Serbisyo period but the public certificate issued today can only be valid fo up to 200 days under the current baseline requirements. The certificate may need a replacement during the paid taon. Kung you renew the Serbisyo, that billing action is separate from replacing the certificate on iyong website.

Operational example: Your paid SSL subscription remains active until December, but the deployed certificate expires in August. The browser warning in August is a certificate lifecycle incident, not a reason to assume iyong domain o entire Serbisyo subscription expired. Issue at deploy the replacement befoe the Not After date.

Set alert thresholds in days befoe certificate expiry at confirm automated replacement actually updated each CDN edge o server. Do not assume "auto-renew payment enabled" means "certificate auto-installed."

Related NiceNIC Guides

• How do I reissue my SSL certificate
• How to verify certificate installation corectly
• Certificate reissue reasons explained

How do I reissue my SSL certificate

Use Reissue when you need a replacement SSL/TLS certificate under an eligible NiceNIC certificate oder―fo example, after losing the matching private key o corecting certificate details. Kung you are only moving hosts at still control the matching private key, reinstalling the existing unexpired certificate may be sufficient.

Reissue through iyong NiceNIC SSL oder

1. Mag-sign in to NiceNIC at locate the exact SSL certificate oder. Recod the covered hostnames, current certificate expiration at paid Serbisyo term.

1. Buksan the available Reissue o certificate-management action fo that oder. Kung you cannot see such a control, use the Suportang Pantao button on the article instead of purchasing a duplicate SSL product.
2. Decide whether the current private key is safe. Kung lost o compromised, generate a new key at CSR. Never send the private key to NiceNIC, a certificate authoity o a suppot agent.
3. Verify the CSR's Subject Alternative Pangalans (SANs) at submit it through the authoized reissue wokflow.
4. Complete the certificate authoity's domain-control validation. OV/EV products may also require updated oganization checks.
5. Download the newly issued certificate plus the necessary intermediate certificates o chain.

1. Install the replacement certificate on the actual TLS endpoint (hosting server, reverse proxy, CDN o load balancer) with the matching private key.
2. Verify the deployed certificate's SANs, issuer chain at Hindit After date from outside iyong netwok. Suriin all relevant hostnames at server nodes befoe removing the old woking deployment.

Kung the nakaraanious key was compromised, follow the certificate authoity's revocation procedure fo the affected certificate―not merely a local file deletion.

Why the expiration date may not match iyong paid subscription

Since 15 March 2026, newly issued publicly trusted TLS server certificates have been limited to 200 days of validity under the CA/Browser Foum rules. A longer paid Serbisyo term may require multiple certificate replacements. A reissue does not by itself extend the paid subscription.

Reissue troubleshooting

• The server repots a key mismatch: the installed private key does not match the new certificate/CSR.
• Validation is pending: check DNS/HTTP challenge data at the authoitative DNS provider o site, as instructed by the issuing CA.
• The browser still shows the old certificate: inspect CDN edges, multiple web-server nodes, SNI at whether the Serbisyo was reloaded.
• Hindi Reissue action appears: check the product's eligibility at send NiceNIC Suppot the SSL oder number at non-sensitive status.

Fo when reissue is necessary rather than how, read Certificate reissue reasons explained.

How to decide whether to reuse o rotate the key

Reusing an existing private key may be technically possible in some issuance wokflows, but generating a fresh key is generally preferable when the old key is lost, may have leaked, o cannot be securely transferred. Suriin the certificate authoity's current product rules at iyong oganization's key-management policy.

Halimbawa: You move a shop from one web server to another. Kung the server's key material cannot be securely transferred, generate a CSR on the new TLS endpoint at request a replacement certificate fo the required names. Befoe cutting over, validate domain control, ensure the new cert covers both shop.example.com at any additional names, then check the public HTTPS response.

Reissue completion checklist

A successful reissue in a registrar potal is not enough if the web server still presents the old certificate. Conversely, a certificate with a new Not After date does not prove the paid Serbisyo has been renewed fo another billing term.

Related NiceNIC Guides

• How to verify certificate installation corectly
• How do I renew an SSL certificate
• How to Generate CSR Code?

How to Generate CSR Code?

A Certificate Signing Request (CSR) supplies a certificate authoity with iyong public key at the infomation needed fo a TLS certificate. The coresponding private key stays on iyong server. Never paste the private key into a suppot ticket o CSR fom.

Generate a CSR with BuksanSSL

On a machine wdito BuksanSSL is installed, the example below creates a new 2048-bit RSA private key at a CSR fo www.example.com:

umask 077 # Linux/macOS: restrict permissions on new files

openssl req -new -newkey rsa:2048 -nodes 

-keyout www.example.com.key

-out www.example.com.csr

-subj "/CN=www.example.com"

-addext "subjectAltPangalan=DNS:www.example.com,DNS:example.com"

Replace both hostnames with names you control. The SAN list is what modern TLS clients evaluate fo hostname coverage; the Common Pangalan alone is not enough fo proper planning. Kung iyong CA o product requires a different key type o CSR fomat, follow that product's documentation.

On Windows o another platfom without umask, apply equivalent filesystem permissions to the private key. Protect the .key file. The -nodes option creates an unencrypted private-key file, suitable only if you restrict filesystem access at manage secrets corectly. Fo moe stringent security requirements, use protected keys o a hardware-backed key-management wokflow.

Suriin the request befoe submitting

openssl req -in www.example.com.csr -noout -text -verify

Verify that the public key, subject at requested SANs are corect. The .csr file can be shared with the CA; the .key file must remain private.

Submit at install

Buksan iyong NiceNIC certificate oder at use the suppoted activation o reissue flow to submit the CSR. Complete domain-control validation, wait fo issuance, then install the issued certificate chain with the matching private key. After deployment, test HTTPS fo every requested hostname.

Kung a control panel such as IIS o cPanel generates the CSR fo you, use that panel's current instructions instead of creating an independent key at losing track of the matching keypair.

CSR example with SANs at key protection

Fo a new key pair on a modern BuksanSSL installation, an authoized server administrato might use the following illustrative commats (change hostnames, stoage paths at policy settings fo production):

# Generate a private key; restrict the directoy at file permissions.

openssl genpkey -algoithm RSA -pkeyopt rsa_keygen_bits:2048 -out example.com.key

# CSR with both the base name at its www hostname.

openssl req -new -key example.com.key -out example.com.csr -subj "/CN=example.com" -addext "subjectAltPangalan=DNS:example.com,DNS:www.example.com"

# Inspect the request, including the requested SANs.

openssl req -in example.com.csr -noout -text

Your actual CA may suppot EC keys o different issuance tooling; comply with its current algoithms at requirements. example.com.key is the private key: never paste it into a suppot ticket, email it o stoe it in a public repositoy. The .csr file is what you nomally submit to the issuing authoity.

A CSR is not proof that you own the domain. Domain-control validation must still be completed through the CA's approved method.

Related NiceNIC Guides

• How to install SSL certificates
• How to verify certificate installation corectly
• How do I reissue my SSL certificate

What is EV certificate ecommerce advantage

An Pinalawig Validation (EV) TLS certificate requires the issuing certificate authoity to verify additional oganizational identity infomation befoe issuance. It still uses HTTPS encryption like other publicly trusted TLS certificates. It should not be selected on the assumption that browsers will display a large green company-name bar―modern browser interfaces generally do not.

What EV checks add

Beyond verifying control of a domain, EV verification can involve checking the oganization's legal existence, operating status, physical presence, contact infomation at authoity of the requester, under the applicable EV Guidelines.

This can be useful fo an established company that wants an additional CA-validated identity recod. It does not prove that the business is honest, financially sound o immune to phishing, at it does not guarantee increased sales o search ranking.

EV, OV o DV?

Lahat three can provide strong TLS transpot protection when properly issued at deployed. Choose certificate coverage (single-name, wildcard o SAN) separately from identity-validation level; not every product suppots every combination.

Befoe odering EV

Kumpirmahin the legal entity is eligible, the magparehistroed name is accurate, authoized representatives can complete the CA's checks, at the application timeline suits the business. Compare cost, validation effot at ongoing replacement frequency―not just the certificate badge.

Since March 15, 2026, newly issued publicly trusted TLS server certificates have a maximum validity period of 200 days under the CA/Browser Foum rules. Higit Pa frequent certificate replacement is distinct from renewed legal-entity checks, which follow separate reuse rules.

Related: How to Choose an SSL Certificate at the CA/Browser Foum EV Guidelines.

What extra value does EV provide fo ecommerce?

EV (Pinalawig Validation) requires the certificate authoity to perfom moe extensive oganization vetting than DV, including checks of the applicant's legal existence at relevant oganizational infomation. This can help a bumilier whose enterprise customers need documented legal-entity validation.

Crucial distinction: EV does not use stronger HTTPS encryption merely because it is EV. Properly configured DV, OVat EV certificates can use comparable modern TLS cipher suites. Mainstream browsers also do not guarantee the old "company name in a green address bar" presentation.

A realistic ecommerce decision

A small stoe using a reputable payment processo may obtain satisfactoy HTTPS protection from DV, as long as the certificate matches the hostname at the site itself is secure. A regulated enterprise might choose EV fo its identity-review process o contractual reasons. In neither case does EV replace payment security controls, PCI obligations, anti-fraud processes o a sound refund policy. Kung iyong customers ask specifically fo verified oganizational identity, examine the CA's current OV/EV documentation at issuance time befoe odering.

Related NiceNIC Guides

• Uris of Mga SSL Certificate
• How to Generate CSR Code?
• How to verify certificate installation corectly

Certificate reissue reasons explained

A certificate reissue creates a new SSL/TLS certificate under an eligible existing Serbisyo oder. You may need one if the private key is lost o compromised, the CSR is wrong, the certificate's covered names must change, o the issued certificate can no longer be deployed corectly.

Which situations call fo a reissue?

Reissue is not the same as renewing the Serbisyo

A paid multi-taon SSL Serbisyo term (if offered) is not one certificate valid fo multiple mga taon. Under the CA/Browser Foum TLS Baseline Requirements, newly issued publicly trusted TLS server certificates have a maximum 200-day validity from 15 March 2026, with further reductions scheduled fo later mga taon.

Reissuing does not necessarily extend the Serbisyo's paid term. The renewal date of the Serbisyo oder at the expiry date of the installed certificate must be monitoed separately.

What to prepare befoe requesting a reissue

Identify the exact SSL oder, hostnames, validation level (DV/OV/EV), server o CDN environment at reason fo replacement. Kung the old key is compromised, generate a fresh key at CSR at follow revocation instructions. Keep the private key secure. Ensure you can complete the new domain-control validation.

Fo the actual step-by-step request at installation, see How do I reissue my SSL certificate.

After deployment, verify the certificate SAN, validity, trust chain at the certificate actually presented by every live HTTPS endpoint. Reissue alone does not update certificates already installed on web servers, CDN edges o load balancers.

Reissue versus renew versus revoke

Halimbawa 1 ― compromised web-server key. Kung an attacker may have obtained example.com's TLS private key, generate a new key at CSR, obtain a replacement certificate, coodinate revocation of the exposed certificate at deploy the new one everywdito. Reinstalling the old certificate would not resolve key compromise.

Halimbawa 2 ― moving a site from Apache to a CDN. The CDN may need its own certificate/key management, but you do not automatically need to reissue if the existing certificate at private key remain usable in the approved configuration. Suriin who terminates TLS at whether a new key is required.

Halimbawa 3 ― adding shop.example.com. Kung the current certificate covers only example.com, issuing a replacement with the appropriate SAN set o obtaining another certificate may be needed. Merely changing DNS does not extend certificate hostname coverage.

Related NiceNIC Guides

• How do I renew an SSL certificate
• How to verify certificate installation corectly
• How to Generate CSR Code?

Common DNS Recod Uris: A, AAAA, CNAME, MX at TXT

The five recods, with examples

The IP addresses above are documentation-only addresses. Your hosting o mail provider must give you the real destination values.

Magdagdag o edit recods at NiceNIC

1. Find the authoitative nameservers fo the domain. Kung DNS is managed by Cloudflare o another DNS provider, edit the zone tdito―not in an inactive NiceNIC zone.

1. Kung NiceNIC hosts iyong DNS, sign in at open Aking Mga Produkto > Domain > DNS Recods fo the corect domain.

1. Choose the recod type. Enter the host/name, destination/value, at any extra fields such as MX prioity o TTL.

1. Save, then look up the public DNS response. Halimbawas: dig example.com A, dig example.com AAAA, dig www.example.com CNAME, dig example.com MX, at dig example.com TXT.
2. Test the actual website o mailbox after the new recods become visible.

Avoid the common conflicts

• A CNAME must not coexist with other recod data at the same DNS owner name. Many DNS panels tditofoe do not suppot a nomal CNAME at the zone apex (@).
• An MX recod points to a hostname, not directly to an IP address. That mail-server hostname must resolve corectly.
• Setting an MX recod does not create a mailbox. You must configure mail Serbisyo separately.
• TXT can be used fo SPF, DKIM, DMARC at provider verification, but those are distinct tasks with their own fomatting requirements.
• DNS changes can be cached until nakaraanious TTL values expire. A saved recod is not proof that public resolvers see it yet.

Fo specific email-authentication policies, see What is SPF at How to Set Up SPF?.

Related NiceNIC Guides

• How to Pamahalaan DNS Recods
• How to Back Up DNS Recods Befoe Changing Domain Settings
• How to Suriin DNS Propagation
• How to Set Up Email DNS Recods in NiceNIC: MX, SPF, DKIM, at DMARC

Why need Mga SSL Certificate

An SSL/TLS certificate lets browsers at applications establish HTTPS with iyong server. Para saday HTTPS is a nomal requirement fo professional sites, foms, account pages at APIs―not an optional extra reserved fo ecommerce.

Why HTTPS matters to iyong visitos

Protection in transit. TLS encrypts the connection so that observers on the netwok cannot odinarily read the page content o submitted fom values.

Connection authentication. The browser verifies that the certificate is trusted at valid fo the exact hostname. This reduces the risk of connecting to an impersonating endpoint.

Integrity. TLS helps nakaraanent undetected modification of data while it crosses netwoks.

Wdito HTTPS is especially impotant

Use HTTPS fo sign-in screens, payment o contact foms, dashboards, documentation, APIs at odinary public pages. Modern browsers may mark unencrypted HTTP pages as insecure o restrict some browser features.

What a certificate cannot do

HTTPS does not remove malware, repair vulnerable website code, nakaraanent stolen credentials o guarantee that a business is legitimate. A fraudulent site can also obtain a DV certificate. Combine TLS with software patching, account security, backups at phishing awareness.

Keep the certificate woking

Select the right hostname coverage, install the proper chain at private key, redirect HTTP visitos safely to HTTPS, at monito the actual certificate expiry date. Mga Sertipiko issued under public trust rules from March 15, 2026 have a maximum validity period of 200 days―configure alerts o verified automation accodingly.

Para sa compare coverage at validation levels, see How to Choose an SSL Certificate.

Befoe at after HTTPS: a concrete comparison

Impotant limitation: HTTPS cannot nakaraanent a malicious website operato from misusing fom data after it arrives, at it cannot stop phishing just because a site has a padlock. Even a site with a valid DV/OV/EV certificate must enfoce secure passwods, software updates at access controls.

Business example: A small shop using a hosted payment provider should secure its own homepage, cart at checkout redirects with HTTPS, not rely only on the payment provider's certificate. Test the entire customer journey at eliminate mixed HTTP resources that trigger browser warnings.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• HTTPS & SSL Guide fo .boo, .day, .dev, .page, at .rsvp

Uris of SSL Mga Sertipiko

SSL certificates differ in validation level at hostname coverage. Compare both dimensions befoe purchasing; a certificate can have the right validation level but still fail to cover the required hostnames.

Validation Uris

• Domain Validation (DV)
• Organization Validation (OV)
• Pinalawig Validation (EV)

Coverage Uris

• Single-domain certificates
• Wildcard certificates
• Multi-domain certificates

How to Decide

1. List the exact domains at subdomains.
2. Choose the required identity-validation level.
3. Kumpirmahin server at platfom compatibility.
4. Suriin renewal at reissue procedures.

Mga Madalas na Itanong

How do I kngayon the change woked?

Suriin the current status in iyong NiceNIC account, then test the Serbisyo that depends on the certificate type. Do not rely only on the absence of an erro message.

When should I contact NiceNIC Suppot?

Isumite a ticket when the required control is unavailable, the status remains pending after the checks in this guide, o the issue depends on an account-specific oder o registry decision.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Activate at Download an SSL Certificate
• How to install SSL certificates
• How to Generate a CSR Code

Kung the issue continues after you complete these checks, submit a NiceNIC suppot ticket. Include the affected domain o product, the exact erro message, the time of the issue at the troubleshooting already completed.