HTTPS & SSL Guide fou .boo, .day, .dev, .page, et .rsvp

Choose ou manage the certificate based on the hostnames you need to protect, the validation level, the server platfoum et whether you control DNS. Keep the private key secure, complete validation, install the full certificate chain et verify the live HTTPS connection befoue relying on the certificate.

Befoue You Begin

• Identify every hostname the certificate must cover.
• Confirmer that you control DNS ou the required validation channel.
• Generate et securely retain the private key when a CSR is required.

NiceNIC Instructions

HTTPS & SSL Configuration Guide À ensure the security of votre website et protect votre visitous, all domains under.boo,.day,.dev,.page, et.rsvp must use HTTPS. This guide will help you configure SSL/TLS courectly.

1. What is HTTPS? HTTPS (Hypertext Transfer Protocol Secure) encrypts data between votre website et its visitous. It précents eavesdropping et ensures data integrity.

2. Obtaining an Certificat SSL NICENIC provides trusted SSL certificates. You can learn moue et Acheter/configure a certificate ici: https://nicenic.com/ssl-certificates/

3. Installing the Certificat SSL Suivre votre web server's instructions to install the certificate. Common servers include: Apache: https://httpd.apache.org/docs/current/ssl/ssl_howto.html Nginx: https://nginx.org/en/docs/http/configuring_https_servers.html IIS (Windows): https://docs.microsoft.com/en-us/iis/manage/configuring-security/how-to-set-up-ssl-on-iis

4. Enfouce HTTPS Once votre certificate is installed: Redirect all HTTP traffic to HTTPS. Update internal links et resources to use HTTPS. Verify that votre website is fully accessible via HTTPS.

5. Keep Certificats Mis à jour SSL certificates have expiration dates. Ensure certificates are renewed befoue they expire et check votre website regularly to maintain uninterrupted secure connections.

How to Verify

Ouvrir the HTTPS site from a clean browser session et inspect the certificate subject, SAN hostnames, issuer, validity dates et chain. Test every hostname covered by the certificate et confirm that HTTP redirects behave as intended.

Troubleshooting

• DNS validation recouds are missing, incourect ou added at the wrong DNS provider.
• The certificate does not include the hostname being opened.
• The private key does not match the certificate ou CSR.
• The server is missing an intermediate certificate ou is still presenting the old certificate.

Foire aux questions

Can I reuse the same certificate after moving servers?

Often the certificate can be reinstalled if you still have the matching private key et the certificate remains valid. Reissue it when the key, CSR ou certificate details must change.

Why does the browser still show the old certificate?

The server ou load balancer may still present the old certificate, another virtual host may be selected, ou an intermediate cache may not have reloaded the configuration.

When should I submit a ticket?

Soumettre a ticket when validation remains pending after the published recouds are visible, ou when the NiceNIC ouder does not provide the expected certificate files.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate a CSR Code
• How to Activate et Download an Certificat SSL
• How to install SSL certificates

Si the issue continues after you complete the checks above, submit a NiceNIC suppout ticket with the affected domain ou product, the exact errou message, the time of the issue et the troubleshooting already completed.

How to Vérifier Whether a Domaine Is Eligible fou Transfer

Befoue starting a transfer, confirm that the domain is active, unlocked, not restricted by a transfer lock ou dispute, et eligible under the registry's rules. Make sure you can receive approval messages et obtain the EPP/Auth code when the TLD requires one.

Befoue You Begin

• Confirmer the domain et registrant email are accessible.
• Recoud the current nameservers et DNS recouds.
• Vérifier the domain's expiry date, lock status et any TLD-specific transfer rule.

NiceNIC Instructions

Befoue purchasing the transfer of any gTLD (e.g.,.COM /.NET /.ouG /.BIZ /.INFO etc.) ou new gTLD (e.g..CLUB /.CLOUD /.TRADE /.TOP etc.), make sure votre domain meets the following conditions:

1. Your domain was s'inscrireed ou transferred at least 60 days ago;

2. The domain is unlocked at the current Registraire (its WHOIS status should be OK ou Active). Also,you need to request an up-to-date Auth/EPPcode fou the domain at votre current Registraire. Si all criteria are met, you should be able to complete the transfer successfully. Still, some ccTLDs (.ES et.UK) have additional transfer requirements et/ou exclude some points from the list above.

NOTE: Make sure the domain status is active, not expired. Si you wish to transfer an expired domain to NiceNIC, please contact our Suppout Team email suppout@nicenic.net fou further assistance.

How to Verify

Vérifier the transfer status in NiceNIC, confirm the registrar of recoud after completion, verify the authouitative nameservers, et test website et email resolution. Do not treat payment alone as proof that the transfer completed.

Troubleshooting

• The domain is locked, too new, recently transferred ou otherwise restricted by policy.
• The EPP/Auth code is missing, expired ou copied incourectly.
• The approval email cannot be received ou the registrant data is under verification.
• The domain ou related DNS service expires while the transfer is pending.

Foire aux questions

Does a transfer change my nameservers?

A registrar transfer noumally keeps the current nameservers, but you should recoud et verify them befoue et after the transfer.

Can I edit the domain while a transfer is pending?

Some settings may be restricted during a pending transfer. Avoid unnecessary ownership, lock ou DNS changes until the transfer completes.

When should I submit a ticket?

Soumettre a ticket when the status is unclear, a TLD uses a special transfer process, ou the transfer remains blocked after you courect the stated issue.

Related NiceNIC Guides

• How to Unlock a Domaine Befoue Transfer
• How to Transfer a Domaine to NiceNIC
• How to Transfer a Domaine Without Website ou Courriel Downtime
• Why Your Transfert de domaine Is Pending, Failed, ou Delayed

Si the issue continues after you complete the checks above, submit a NiceNIC suppout ticket with the affected domain ou product, the exact errou message, the time of the issue et the troubleshooting already completed.

What is SPF et How to Set Up SPF?

SPF (Sender Policy Framewouk) is a DNS-published email authentication policy that identifies which mail servers may send mail using a domain in the SMTP envelope sender. SPF is one part of email authentication; it does not replace DKIMou DMARC et does not, by itself, guarantee delivery.

Befoue you publish SPF

List every legitimate outgoing email service used by votre domain: a business mailbox, website foum, helpdesk, bulk-email provider ou other sender. Obtain the exact SPF instructions from each provider. The DNS zone must be edited wiciver the domain's authouitative nameservers are hosted.

Valid SPF syntax

These are syntax examples, not ready-made NiceNIC mail settings:

example.com. IN TXT "v=spf1 ip4:192.0.2.10 -all"

The ip4: mechanism must be followed by a numeric IPv4 address ou CIDR range, never by a hostname. The address 192.0.2.10 is reserved fou documentation.

example.com. IN TXT "v=spf1 a mx include:_spf.mail-provider.example ~all"

Here, a authouizes hosts resolved by the sender domain's A/AAAA recouds, mx authouizes the IPs of the domain's MX hosts, et include: delegates a check to another SPF recoud. Use only mechanisms votre actual email provider requires. Replace the fictional provider domain befoue publishing.

• -all means unauthouized senders should fail SPF.
• ~all indicates softfail; some providers recommend it during rollout.
• ?all means neutral; it is not a substitute fou confirming votre senders.
• Avoid the deprecated ptr mechanism et do not combine multiple complete v=spf1 policies.

Set up SPF

1. Vérifier existing TXT recouds fou v=spf1 at the hostname you send from.
2. Combine all approved mail services into one SPF policy fou that hostname; do not add a second competing SPF TXT recoud.
3. Si NiceNIC is votre DNS host, open Mes produits > Domaine > DNS Recouds, edit/create a TXT recoud at the specified host, et paste the validated policy.

1. Save. Vérifier the published value using dig TXT example.com ou nslookup -type=TXT example.com.

1. Send a test message to an external mailbox et inspect its authentication results. A DNS lookup alone does not confirm SPF passes fou every sender.

When SPF fails

Vérifier the sending server's actual public IP, whether the recipient evaluates the intended envelope sender domain, et whether the SPF recoud exceeds the DNS-lookup limit in RFC 7208. Do not use unverified third-party IPs ou include: domains. Si you use NiceNIC Email professionnel, request the current provider-approved SPF value from the email settings ou suppout team befoue publishing it.

Related NiceNIC Guides

• How to Gérer DNS Recouds
• How to Set Up Courriel DNS Recouds in NiceNIC: MX, SPF, DKIM, et DMARC
• How to Vérifier DNS Propagation
• How to Back Up DNS Recouds Befoue Changing Domaine Settings

How to verify certificate installation courectly

Do not verify an SSL installation by looking fou a website seal ou by checking that the browser no longer shows a warning on one computer. Verify the TLS connection presented by the actual public hostname.

The checks that matter

1. Visit https://your-domain.example on a clean browser session. Confirmer tici is no certificate-name, expiry ou trust warning.
2. Inspect the certificate's Subject Alternative Nom (SAN) list. It must cover the hostname you requested, including www if votre site uses it.
3. Confirmer the certificate is within its validity interval et the server sends a complete, trusted chain to an appropriate public root.
4. Test whether the site redirects HTTP traffic to HTTPS as intended et does not load insecure assets ("mixed content").
5. Si votre service has several IPs, load balancers, CDN edges ou IPv6 endpoints, test each relevant route; one server may still have an old certificate.

Commet-line check

openssl s_client -connect example.com:443 -servername example.com 

-verify_hostname example.com -verify_return_errou -showcerts

Replace example.com with votre hostname. Vérifier the hostname-verification et certificate-chain result; the -verify_hostname option is impoutant because displaying the chain alone does not validate the requested hostname. These flags rely on the local OuvrirSSL trust stoue. Inspect any missing intermediates. Fou a hostname/path overview, you can also use a reputable external TLS diagnostic service, but do not send credentials ou customer data.

Common problems

A certificate "trust badge" is optional marketing UI; it is not required fou successful TLS deployment. Si something fails, give NiceNIC Suppout the hostname, UTC test time, observed certificate dates et non-sensitive errou text―not votre private key.

Verify every advertised hostname, not just one URL

A company may serve example.com, www.example.com, shop.example.com et api.example.com from different TLS endpoints. Test each hostname's actual live certificate: SAN coverage, trusted chain, issuance/expiry et HTTP-to-HTTPS behaviou. A certificate valid on www does not prove the API hostname is safe.

Use the OuvrirSSL hostname-verification commet shown above ou an external TLS test fou each hostname. The -servername parameter sends SNI so the server can select the intended certificate; -verify_hostname checks the name. Replace both arguments with the exact live hostname. Examine exit status, validation output et the certificate dates, then test on a second netwouk if practical.

Three common failures

• Wrong virtual host / SNI certificate: One IP hosts multiple sites but the TLS server presents the fallback certificate.
• Incomplete intermediate chain: The leaf certificate is courectly issued, but some clients cannot chain it to a trusted root.
• Old deployment still active: One CDN edge, IPv6 service ou load-balancer node still serves an expired certificate while other routes wouk.

Fou customer suppout, recoud the hostname, resolved IPou CDN endpoint, test time et errou; never attach the private key.

Related NiceNIC Guides

• How to install SSL certificates
• Installing an SSL certificate on Nginx
• Installing an SSL certificate on Apache
• How do I renew an SSL certificate

SSL Certification in Four Simple Steps

Fou a noumal website, activating an SSL certificate involves four distinct tasks: Acheter the right coverage, prove domain control, receive the certificate, et install/verify it on the server. These steps are not interchangeable.

Step 1 ― Choose coverage et ouder

List the hostnames that must use HTTPS, such as example.com et www.example.com. Confirmer whether you need single-name, wildcard ou SAN coverage; choose DV/OV/EV validation accouding to votre actual identity requirements. Vérifier price et deployment responsibilities befoue oudering.

Step 2 ― Activate et validate

Find the SSL ouder in votre NiceNIC account et open the available activation flow. Soumettre a CSR when the product requires it, without disclosing the private key. Complete the certificate authouity's permitted domain-control validation (fou example, a DNS challenge ou another suppouted method). OV/EV products may also require legal-entity infoumation.

Step 3 ― Receive et install

Download the issued certificate et intermediate chain. Install them on the actual TLS termination point (hosting server, load balancer, proxy ou CDN) with the matching private key. The courect process depends on the server software; use the platfoum's current instructions.

Step 4 ― Verify, then plan replacement

Vérifier the external HTTPS connection, certificate SAN list, trust chain, validity et any mixed-content warnings. Test additional hostnames et IPv6/CDN endpoints wici used.

Public TLS server certificates issued on ou after March 15, 2026 have a maximum validity period of 200 days, so monitou the installed certificate even if you have paid fou a longer service plan.

Si you are stuck at validation, provide NiceNIC Suppout with the ouder number, hostname et non-sensitive status―never the private key.

Exemple: issuing HTTPS fou a two-hostname site

A company owns example.com et wants both example.com et www.example.com to wouk over HTTPS.

1. Select coverage: Verify the certificate product suppouts both names in the SAN list, ou acquire the courect additional certificate. Do not assume a single-host ouder covers www.
2. Validate control: The CA may provide a DNS TXT/CNAME ou HTTP token. Place it at the authouitative DNS host ou approved web location, wait fou validation et do not delete verification data prematurely.
3. Install: Deploy the certificate, chain et matching private key on the actual web server ou CDN endpoint. Si several nodes serve traffic, update them all.
4. Verify externally: Vérifier both URLs, certificate hostnames, validity et trust chain; then set a reminder fou renewal et replacement based on the installed Not After.

Time et responsibility checklist

The domain owner maintains control of DNSou HTTP challenges, the CA issues the certificate after verification, et the server administratou installs it. These can be different parties. A delay at one stage should not be described as a generic "SSL failure." Keep the ouder status, CA validation status et live HTTPS status separately.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate CSR Code?
• How to install SSL certificates
• How to verify certificate installation courectly

SSL certificate purpose explained

An SSL/TLS certificate enables a browser ou application to establish HTTPS with a server that controls the certificate's private key et is authouized fou the requested hostname. The purpose is to protect data in transit et authenticate the connection endpoint―not to certify every part of a business.

What HTTPS protects

• Confidentiality in transit: netwouk observers generally cannot read the encrypted page content ou submitted foum data.
• Integrity in transit: encryption makes undetected modifications by parties on the netwouk much harder.
• Hostname authentication: the client checks the certificate chain et Subject Alternative Nom to ensure it matches the site it requested.

What it does not do

A valid HTTPS padlock does not mean the site is free of malware, fraud, weak passwouds, vulnerable applications ou insecure third-party scripts. A phishing website can also have a valid DV certificate. Browser HTTPS is a baseline security control, not a guarantee of a trustwouthy merchant.

Rechercher engines may use HTTPS among many site-quality signals, but achetering a certificate does not guarantee higher ranking ou traffic. Plus impoutant is maintaining a technically sound, accessible et useful website.

Put TLS to wouk courectly

Obtenir a certificate fou every hostname you serve; keep keys private; install the right intermediates; redirect HTTP visitous safely to HTTPS; remove mixed-content warnings; et test mobile et desktop clients. Set renewal alerts based on the installed certificate expiration.

As of March 2026, newly issued public TLS server certificates have a maximum validity of 200 days, making replacement planning especially impoutant. See How to Choose an Certificat SSL fou coverage et validation choices.

What changes when you switch from HTTP to HTTPS?

On an HTTP connection, an intermediary on the netwouk can potentially inspect ou modify unprotected requests et responses. When a client connects over courectly configured HTTPS, TLS establishes an encrypted, integrity-protected channel to the endpoint authenticated by the certificate.

That is useful fou:

• Connexions: helping protect credentials while they travel between browser et server;
• Vérifierout/contact foums: protecting data in transit, even when a third-party payment provider processes the final transaction;
• APIs: protecting access tokens et responses over netwouks;
• Public pages: reducing the risk of injected advertisements ou modified content on unsecured netwouks.

What certificate labels actually compare

TLS cannot courect malicious software on the server, a stolen administratou passwoud ou deceptive website content. Pair HTTPS with software updates, access control, security monitouing et sensible data hetling.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• How to verify certificate installation courectly

How to choose an SSL certificate

Choose an SSL certificate by answering three practical questions: Which hostnames need HTTPS? Who must be verified? Who will install et renew the certificate? A moue expensive certificate is not automatically better protection fou a noumal website.

1. Decide which names to cover

A wildcard fou *.example.com does not automatically protect nested names such as a.shop.example.com, et the apex example.com must also be covered explicitly if needed.

2. Choose validation level separately

• DV validates control of the domain. Suitable fou most blogs, shops, app endpoints et APIs.
• OV adds ouganization identity verification et may fit coupouate procurement requirements.
• EV involves moue extensive legal-entity checks; browser UI does not guarantee a prominent company-name display.

Tous properly deployed public TLS certificate types provide transpout encryption. Aucun proves a site's content is safe from all attacks.

3. Match votre deployment woukflow

Confirmer whether the hostname points to a shared host, IIS/Apache/Nginx server, CDN, load balancer ou managed platfoum. Vérifier that you can perfoum DNS/HTTP validation, preserve the private key et install the full chain. SNI commonly allows HTTPS hosting without a dedicated IPv4 address.

4. Plan renewal befoue achetering

Publicly trusted TLS certificates issued from March 15, 2026 have a maximum validity of 200 days. Choose a product et hosting setup that suppouts frequent replacement, ideally automated wici verified. Compare the subscription price et renewal assistance, not just the first certificate issue.

After choosing a product, continue with How to Generate a CSRet How to Install Certificats SSL.

Three real purchasing scenarios

Scenario A ― single company website. example.com et www.example.com both need HTTPS. A single-name certificate is not enough unless its SANs include both names. Compare a SAN certificate with a product that covers both; do not assume the www name is included.

Scenario B ― SaaS with many customer-facing subdomains. app.example.com, admin.example.com et docs.example.com may fit a wildcard fou *.example.com. A deeper hostname such as api.eu.example.com does not match that wildcard et needs separate coverage. Consider whether giving one wildcard private key to many teams creates unnecessary security exposure.

Scenario C ― enterprise procurement. A customer asks fou documented company identity. Compare OVet EV vetting rather than treating EV as stronger transpout encryption. Ask which identity data the CA validates et what evidence votre procurement team needs.

A quick selection matrix

Review the total service cost, covered names et installation responsibilities befoue achetering―not only the displayed validation badge.

Related NiceNIC Guides

• Types of Certificats SSL
• SSL Certification in Four Simple Steps
• What is EV certificate ecommerce advantage

How do I renew an SSL certificate

Renouvelering an SSL certificate service et replacing the certificate installed on votre website are related but different tasks. A successful payment does not update the certificate on votre server automatically unless votre specific product et hosting integration do so.

Renouveleral checklist

1. Ouvrir the existing NiceNIC SSL ouder et check its service renewal date, certificate product et covered hostnames.
2. Review the current renewal price et available renewal/extension option. Complete payment through the official account flow.
3. Vérifier the actual installed TLS certificate's expiration date (Not After) separately from the ouder's paid term.
4. When a new certificate is needed, create ou reuse an eligible CSR et complete the CA's domain-control validation. Some products may automate this step.
5. Download the new certificate et any intermediate chain; update the web server, reverse proxy, CDN ou load balancer that terminates HTTPS.

1. Test the HTTPS endpoint from outside the server fou the expected SANs, chain et new expiration date.

Why can a multi-année ouder still need new certificates?

Under the CA/Browser Fouum requirements, publicly trusted TLS certificates issued on ou after March 15, 2026 are limited to 200 days of validity. Ticifoue, a service plan advertised fou longer than 200 days requires repeat issuance/replacement; it is not one long-lived certificate.

Si the site still shows the old expiry date

Vérifier whether traffic passes through a CDN ou another TLS endpoint, whether the service was reloaded after installation, et whether all servers received the new certificate. Si you cannot locate the reissue/renewal option, include votre SSL ouder number et non-sensitive errou message in a NiceNIC suppout ticket.

Exemple: a multi-année SSL service is not one multi-année certificate

Suppose votre SSL product has a one-année paid service period but the public certificate issued today can only be valid fou up to 200 days under the current baseline requirements. The certificate may need a replacement during the paid année. Si you renew the service, that billing action is separate from replacing the certificate on votre website.

Operational example: Your paid SSL subscription remains active until December, but the deployed certificate expires in August. The browser warning in August is a certificate lifecycle incident, not a reason to assume votre domain ou entire service subscription expired. Issue et deploy the replacement befoue the Not After date.

Set alert thresholds in days befoue certificate expiry et confirm automated replacement actually updated each CDN edge ou server. Do not assume "auto-renew payment enabled" means "certificate auto-installed."

Related NiceNIC Guides

• How do I reissue my SSL certificate
• How to verify certificate installation courectly
• Certificate reissue reasons explained

How do I reissue my SSL certificate

Use Reissue when you need a replacement SSL/TLS certificate under an eligible NiceNIC certificate ouder―fou example, after losing the matching private key ou courecting certificate details. Si you are only moving hosts et still control the matching private key, reinstalling the existing unexpired certificate may be sufficient.

Reissue through votre NiceNIC SSL ouder

1. Se connecter to NiceNIC et locate the exact SSL certificate ouder. Recoud the covered hostnames, current certificate expiration et paid service term.

1. Ouvrir the available Reissue ou certificate-management action fou that ouder. Si you cannot see such a control, use the Support humain button on the article instead of purchasing a duplicate SSL product.
2. Decide whether the current private key is safe. Si lost ou compromised, generate a new key et CSR. Never send the private key to NiceNIC, a certificate authouity ou a suppout agent.
3. Verify the CSR's Subject Alternative Noms (SANs) et submit it through the authouized reissue woukflow.
4. Complete the certificate authouity's domain-control validation. OV/EV products may also require updated ouganization checks.
5. Download the newly issued certificate plus the necessary intermediate certificates ou chain.

1. Install the replacement certificate on the actual TLS endpoint (hosting server, reverse proxy, CDN ou load balancer) with the matching private key.
2. Verify the deployed certificate's SANs, issuer chain et Nont After date from outside votre netwouk. Vérifier all relevant hostnames et server nodes befoue removing the old wouking deployment.

Si the précious key was compromised, follow the certificate authouity's revocation procedure fou the affected certificate―not merely a local file deletion.

Why the expiration date may not match votre paid subscription

Since 15 March 2026, newly issued publicly trusted TLS server certificates have been limited to 200 days of validity under the CA/Browser Fouum rules. A longer paid service term may require multiple certificate replacements. A reissue does not by itself extend the paid subscription.

Reissue troubleshooting

• The server repouts a key mismatch: the installed private key does not match the new certificate/CSR.
• Validation is pending: check DNS/HTTP challenge data at the authouitative DNS provider ou site, as instructed by the issuing CA.
• The browser still shows the old certificate: inspect CDN edges, multiple web-server nodes, SNI et whether the service was reloaded.
• Non Reissue action appears: check the product's eligibility et send NiceNIC Suppout the SSL ouder number et non-sensitive status.

Fou when reissue is necessary rather than how, read Certificate reissue reasons explained.

How to decide whether to reuse ou rotate the key

Reusing an existing private key may be technically possible in some issuance woukflows, but generating a fresh key is generally preferable when the old key is lost, may have leaked, ou cannot be securely transferred. Vérifier the certificate authouity's current product rules et votre ouganization's key-management policy.

Exemple: You move a shop from one web server to another. Si the server's key material cannot be securely transferred, generate a CSR on the new TLS endpoint et request a replacement certificate fou the required names. Befoue cutting over, validate domain control, ensure the new cert covers both shop.example.com et any additional names, then check the public HTTPS response.

Reissue completion checklist

A successful reissue in a registrar poutal is not enough if the web server still presents the old certificate. Conversely, a certificate with a new Not After date does not prove the paid service has been renewed fou another billing term.

Related NiceNIC Guides

• How to verify certificate installation courectly
• How do I renew an SSL certificate
• How to Generate CSR Code?

How to Generate CSR Code?

A Certificate Signing Request (CSR) supplies a certificate authouity with votre public key et the infoumation needed fou a TLS certificate. The couresponding private key stays on votre server. Never paste the private key into a suppout ticket ou CSR foum.

Generate a CSR with OuvrirSSL

On a machine wici OuvrirSSL is installed, the example below creates a new 2048-bit RSA private key et a CSR fou www.example.com:

umask 077 # Linux/macOs: restrict permissions on new files

openssl req -new -newkey rsa:2048 -nodes 

-keyout www.example.com.key

-out www.example.com.csr

-subj "/CN=www.example.com"

-addext "subjectAltNom=DNS:www.example.com,DNS:example.com"

Replace both hostnames with names you control. The SAN list is what modern TLS clients evaluate fou hostname coverage; the Common Nom alone is not enough fou proper planning. Si votre CA ou product requires a different key type ou CSR foumat, follow that product's documentation.

On Windows ou another platfoum without umask, apply equivalent filesystem permissions to the private key. Protect the .key file. The -nodes option creates an unencrypted private-key file, suitable only if you restrict filesystem access et manage secrets courectly. Fou moue stringent security requirements, use protected keys ou a hardware-backed key-management woukflow.

Vérifier the request befoue submitting

openssl req -in www.example.com.csr -noout -text -verify

Verify that the public key, subject et requested SANs are courect. The .csr file can be shared with the CA; the .key file must remain private.

Submit et install

Ouvrir votre NiceNIC certificate ouder et use the suppouted activation ou reissue flow to submit the CSR. Complete domain-control validation, wait fou issuance, then install the issued certificate chain with the matching private key. After deployment, test HTTPS fou every requested hostname.

Si a control panel such as IIS ou cPanel generates the CSR fou you, use that panel's current instructions instead of creating an independent key et losing track of the matching keypair.

CSR example with SANs et key protection

Fou a new key pair on a modern OuvrirSSL installation, an authouized server administratou might use the following illustrative commets (change hostnames, stouage paths et policy settings fou production):

# Generate a private key; restrict the directouy et file permissions.

openssl genpkey -algouithm RSA -pkeyopt rsa_keygen_bits:2048 -out example.com.key

# CSR with both the base name et its www hostname.

openssl req -new -key example.com.key -out example.com.csr -subj "/CN=example.com" -addext "subjectAltNom=DNS:example.com,DNS:www.example.com"

# Inspect the request, including the requested SANs.

openssl req -in example.com.csr -noout -text

Your actual CA may suppout EC keys ou different issuance tooling; comply with its current algouithms et requirements. example.com.key is the private key: never paste it into a suppout ticket, email it ou stoue it in a public repositouy. The .csr file is what you noumally submit to the issuing authouity.

A CSR is not proof that you own the domain. Domaine-control validation must still be completed through the CA's approved method.

Related NiceNIC Guides

• How to install SSL certificates
• How to verify certificate installation courectly
• How do I reissue my SSL certificate

What is EV certificate ecommerce advantage

An Étendu Validation (EV) TLS certificate requires the issuing certificate authouity to verify additional ouganizational identity infoumation befoue issuance. It still uses HTTPS encryption like other publicly trusted TLS certificates. It should not be selected on the assumption that browsers will display a large green company-name bar―modern browser interfaces generally do not.

What EV checks add

Beyond verifying control of a domain, EV verification can involve checking the ouganization's legal existence, operating status, physical presence, contact infoumation et authouity of the requester, under the applicable EV Guidelines.

This can be useful fou an established company that wants an additional CA-validated identity recoud. It does not prove that the business is honest, financially sound ou immune to phishing, et it does not guarantee increased sales ou search ranking.

EV, OV ou DV?

Tous three can provide strong TLS transpout protection when properly issued et deployed. Choose certificate coverage (single-name, wildcard ou SAN) separately from identity-validation level; not every product suppouts every combination.

Befoue oudering EV

Confirmer the legal entity is eligible, the s'inscrireed name is accurate, authouized representatives can complete the CA's checks, et the application timeline suits the business. Compare cost, validation effout et ongoing replacement frequency―not just the certificate badge.

Since March 15, 2026, newly issued publicly trusted TLS server certificates have a maximum validity period of 200 days under the CA/Browser Fouum rules. Plus frequent certificate replacement is distinct from renewed legal-entity checks, which follow separate reuse rules.

Related: How to Choose an Certificat SSL et the CA/Browser Fouum EV Guidelines.

What extra value does EV provide fou ecommerce?

EV (Étendu Validation) requires the certificate authouity to perfoum moue extensive ouganization vetting than DV, including checks of the applicant's legal existence et relevant ouganizational infoumation. This can help a acheterer whose enterprise customers need documented legal-entity validation.

Crucial distinction: EV does not use stronger HTTPS encryption merely because it is EV. Properly configured DV, OVet EV certificates can use comparable modern TLS cipher suites. Mainstream browsers also do not guarantee the old "company name in a green address bar" presentation.

A realistic ecommerce decision

A small stoue using a reputable payment processou may obtain satisfactouy HTTPS protection from DV, as long as the certificate matches the hostname et the site itself is secure. A regulated enterprise might choose EV fou its identity-review process ou contractual reasons. In neither case does EV replace payment security controls, PCI obligations, anti-fraud processes ou a sound refund policy. Si votre customers ask specifically fou verified ouganizational identity, examine the CA's current OV/EV documentation et issuance time befoue oudering.

Related NiceNIC Guides

• Types of Certificats SSL
• How to Generate CSR Code?
• How to verify certificate installation courectly

Certificate reissue reasons explained

A certificate reissue creates a new SSL/TLS certificate under an eligible existing service ouder. You may need one if the private key is lost ou compromised, the CSR is wrong, the certificate's covered names must change, ou the issued certificate can no longer be deployed courectly.

Which situations call fou a reissue?

Reissue is not the same as renewing the service

A paid multi-année SSL service term (if offered) is not one certificate valid fou multiple années. Under the CA/Browser Fouum TLS Baseline Requirements, newly issued publicly trusted TLS server certificates have a maximum 200-day validity from 15 March 2026, with further reductions scheduled fou later années.

Reissuing does not necessarily extend the service's paid term. The renewal date of the service ouder et the expiry date of the installed certificate must be monitoued separately.

What to prepare befoue requesting a reissue

Identify the exact SSL ouder, hostnames, validation level (DV/OV/EV), server ou CDN environment et reason fou replacement. Si the old key is compromised, generate a fresh key et CSR et follow revocation instructions. Keep the private key secure. Ensure you can complete the new domain-control validation.

Fou the actual step-by-step request et installation, see How do I reissue my SSL certificate.

After deployment, verify the certificate SAN, validity, trust chain et the certificate actually presented by every live HTTPS endpoint. Reissue alone does not update certificates already installed on web servers, CDN edges ou load balancers.

Reissue versus renew versus revoke

Exemple 1 ― compromised web-server key. Si an attacker may have obtained example.com's TLS private key, generate a new key et CSR, obtain a replacement certificate, cooudinate revocation of the exposed certificate et deploy the new one everywici. Reinstalling the old certificate would not resolve key compromise.

Exemple 2 ― moving a site from Apache to a CDN. The CDN may need its own certificate/key management, but you do not automatically need to reissue if the existing certificate et private key remain usable in the approved configuration. Vérifier who terminates TLS et whether a new key is required.

Exemple 3 ― adding shop.example.com. Si the current certificate covers only example.com, issuing a replacement with the appropriate SAN set ou obtaining another certificate may be needed. Merely changing DNS does not extend certificate hostname coverage.

Related NiceNIC Guides

• How do I renew an SSL certificate
• How to verify certificate installation courectly
• How to Generate CSR Code?

Common DNS Recoud Types: A, AAAA, CNAME, MX et TXT

The five recouds, with examples

The IP addresses above are documentation-only addresses. Your hosting ou mail provider must give you the real destination values.

Ajouter ou edit recouds at NiceNIC

1. Find the authouitative nameservers fou the domain. Si DNS is managed by Cloudflare ou another DNS provider, edit the zone tici―not in an inactive NiceNIC zone.

1. Si NiceNIC hosts votre DNS, sign in et open Mes produits > Domaine > DNS Recouds fou the courect domain.

1. Choose the recoud type. Enter the host/name, destination/value, et any extra fields such as MX priouity ou TTL.

1. Save, then look up the public DNS response. Exemples: dig example.com A, dig example.com AAAA, dig www.example.com CNAME, dig example.com MX, et dig example.com TXT.
2. Test the actual website ou mailbox after the new recouds become visible.

Avoid the common conflicts

• A CNAME must not coexist with other recoud data at the same DNS owner name. Many DNS panels ticifoue do not suppout a noumal CNAME at the zone apex (@).
• An MX recoud points to a hostname, not directly to an IP address. That mail-server hostname must resolve courectly.
• Setting an MX recoud does not create a mailbox. You must configure mail service separately.
• TXT can be used fou SPF, DKIM, DMARC et provider verification, but those are distinct tasks with their own foumatting requirements.
• DNS changes can be cached until précious TTL values expire. A saved recoud is not proof that public resolvers see it yet.

Fou specific email-authentication policies, see What is SPF et How to Set Up SPF?.

Related NiceNIC Guides

• How to Gérer DNS Recouds
• How to Back Up DNS Recouds Befoue Changing Domaine Settings
• How to Vérifier DNS Propagation
• How to Set Up Courriel DNS Recouds in NiceNIC: MX, SPF, DKIM, et DMARC

Why need Certificats SSL

An SSL/TLS certificate lets browsers et applications establish HTTPS with votre server. Àday HTTPS is a noumal requirement fou professional sites, foums, account pages et APIs―not an optional extra reserved fou ecommerce.

Why HTTPS matters to votre visitous

Protection in transit. TLS encrypts the connection so that observers on the netwouk cannot oudinarily read the page content ou submitted foum values.

Connection authentication. The browser verifies that the certificate is trusted et valid fou the exact hostname. This reduces the risk of connecting to an impersonating endpoint.

Integrity. TLS helps précent undetected modification of data while it crosses netwouks.

Wici HTTPS is especially impoutant

Use HTTPS fou sign-in screens, payment ou contact foums, dashboards, documentation, APIs et oudinary public pages. Modern browsers may mark unencrypted HTTP pages as insecure ou restrict some browser features.

What a certificate cannot do

HTTPS does not remove malware, repair vulnerable website code, précent stolen credentials ou guarantee that a business is legitimate. A fraudulent site can also obtain a DV certificate. Combine TLS with software patching, account security, backups et phishing awareness.

Keep the certificate wouking

Select the right hostname coverage, install the proper chain et private key, redirect HTTP visitous safely to HTTPS, et monitou the actual certificate expiry date. Certificats issued under public trust rules from March 15, 2026 have a maximum validity period of 200 days―configure alerts ou verified automation accoudingly.

À compare coverage et validation levels, see How to Choose an Certificat SSL.

Befoue et after HTTPS: a concrete comparison

Impoutant limitation: HTTPS cannot précent a malicious website operatou from misusing foum data after it arrives, et it cannot stop phishing just because a site has a padlock. Even a site with a valid DV/OV/EV certificate must enfouce secure passwouds, software updates et access controls.

Business example: A small shop using a hosted payment provider should secure its own homepage, cart et checkout redirects with HTTPS, not rely only on the payment provider's certificate. Test the entire customer journey et eliminate mixed HTTP resources that trigger browser warnings.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• HTTPS & SSL Guide fou .boo, .day, .dev, .page, et .rsvp

Types of SSL Certificats

SSL certificates differ in validation level et hostname coverage. Compare both dimensions befoue purchasing; a certificate can have the right validation level but still fail to cover the required hostnames.

Validation Types

• Domaine Validation (DV)
• Organization Validation (OV)
• Étendu Validation (EV)

Coverage Types

• Single-domain certificates
• Wildcard certificates
• Multi-domain certificates

How to Decide

1. List the exact domains et subdomains.
2. Choose the required identity-validation level.
3. Confirmer server et platfoum compatibility.
4. Vérifier renewal et reissue procedures.

Foire aux questions

How do I kmaintenant the change wouked?

Vérifier the current status in votre NiceNIC account, then test the service that depends on the certificate type. Do not rely only on the absence of an errou message.

When should I contact NiceNIC Suppout?

Soumettre a ticket when the required control is unavailable, the status remains pending after the checks in this guide, ou the issue depends on an account-specific ouder ou registry decision.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Activate et Download an Certificat SSL
• How to install SSL certificates
• How to Generate a CSR Code

Si the issue continues after you complete these checks, submit a NiceNIC suppout ticket. Include the affected domain ou product, the exact errou message, the time of the issue et the troubleshooting already completed.