HTTPS & SSL Guide fvagy .boo, .day, .dev, .page, és .rsvp

Choose vagy manage the certificate based on the hostnames you need to protect, the validation level, the server platfvagym és whether you control DNS. Keep the private key secure, complete validation, install the full certificate chain és verify the live HTTPS connection befvagye relying on the certificate.

Befvagye You Begin

• Identify every hostname the certificate must cover.
• Megerősítés that you control DNS vagy the required validation channel.
• Generate és securely retain the private key when a CSR is required.

NiceNIC Instructions

HTTPS & SSL Configuration Guide Hozzá ensure the security of a te website és protect a te visitvagys, all domains under.boo,.day,.dev,.page, és.rsvp must use HTTPS. This guide will help you configure SSL/TLS cvagyrectly.

1. What is HTTPS? HTTPS (Hypertext Transfer Protocol Secure) encrypts data between a te website és its visitvagys. It előzőents eavesdropping és ensures data integrity.

2. Obtaining an SSL tanúsítvány NICENIC provides trusted SSL certificates. You can learn mvagye és vásárlás/configure a certificate itt: https://nicenic.com/ssl-certificates/

3. Installing the SSL tanúsítvány Követés a te web server's instructions to install the certificate. Common servers include: Apache: https://httpd.apache.org/docs/current/ssl/ssl_howto.html Nginx: https://nginx.org/en/docs/http/configuring_https_servers.html IIS (Windows): https://docs.microsoft.com/en-us/iis/manage/configuring-security/how-to-set-up-ssl-on-iis

4. Enfvagyce HTTPS Once a te certificate is installed: Redirect all HTTP traffic to HTTPS. Update internal links és resources to use HTTPS. Verify that a te website is fully accessible via HTTPS.

5. Keep Tanúsítványok Frissítve SSL certificates have expiration dates. Ensure certificates are renewed befvagye they expire és check a te website regularly to maintain uninterrupted secure connections.

How to Verify

Megnyitás the HTTPS site from a clean browser session és inspect the certificate subject, SAN hostnames, issuer, validity dates és chain. Test every hostname covered by the certificate és confirm that HTTP redirects behave as intended.

Troubleshooting

• DNS validation recvagyds are missing, incvagyrect vagy added at the wrong DNS provider.
• The certificate does not include the hostname being opened.
• The private key does not match the certificate vagy CSR.
• The server is missing an intermediate certificate vagy is still presenting the old certificate.

Gyakran Ismételt Kérdések

Can I reuse the same certificate after moving servers?

Often the certificate can be reinstalled if you still have the matching private key és the certificate remains valid. Reissue it when the key, CSR vagy certificate details must change.

Why does the browser still show the old certificate?

The server vagy load balancer may still present the old certificate, another virtual host may be selected, vagy an intermediate cache may not have reloaded the configuration.

When should I submit a ticket?

Küldés a ticket when validation remains pending after the published recvagyds are visible, vagy when the NiceNIC vagyder does not provide the expected certificate files.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate a CSR Code
• How to Activate és Download an SSL tanúsítvány
• How to install SSL certificates

Ha the issue continues after you complete the checks above, submit a NiceNIC suppvagyt ticket with the affected domain vagy product, the exact errvagy message, the time of the issue és the troubleshooting already completed.

How to Ellenőrzés Whether a Domain Is Eligible fvagy Transfer

Befvagye starting a transfer, confirm that the domain is active, unlocked, not restricted by a transfer lock vagy dispute, és eligible under the registry's rules. Make sure you can receive approval messages és obtain the EPP/Auth code when the TLD requires one.

Befvagye You Begin

• Megerősítés the domain és registrant email are accessible.
• Recvagyd the current nameservers és DNS recvagyds.
• Ellenőrzés the domain's expiry date, lock status és any TLD-specific transfer rule.

NiceNIC Instructions

Befvagye purchasing the transfer of any gTLD (e.g.,.COM /.NET /.VAGYG /.BIZ /.INFO etc.) vagy new gTLD (e.g..CLUB /.CLOUD /.TRADE /.TOP etc.), make sure a te domain meets the following conditions:

1. Your domain was regisztrációed vagy transferred at least 60 days ago;

2. The domain is unlocked at the current Regisztrátor (its WHOIS status should be OK vagy Active). Also,you need to request an up-to-date Auth/EPPcode fvagy the domain at a te current Regisztrátor. Ha all criteria are met, you should be able to complete the transfer successfully. Still, some ccTLD-k (.ES és.UK) have additional transfer requirements és/vagy exclude some points from the list above.

NOTE: Make sure the domain status is active, not expired. Ha you wish to transfer an expired domain to NiceNIC, please contact our Suppvagyt Team email suppvagyt@nicenic.net fvagy further assistance.

How to Verify

Ellenőrzés the transfer status in NiceNIC, confirm the registrar of recvagyd after completion, verify the authvagyitative nameservers, és test website és email resolution. Do not treat payment alone as proof that the transfer completed.

Troubleshooting

• The domain is locked, too new, recently transferred vagy otherwise restricted by policy.
• The EPP/Auth code is missing, expired vagy copied incvagyrectly.
• The approval email cannot be received vagy the registrant data is under verification.
• The domain vagy related DNS szolgáltatás expires while the transfer is pending.

Gyakran Ismételt Kérdések

Does a transfer change my nameservers?

A registrar transfer nvagymally keeps the current nameservers, but you should recvagyd és verify them befvagye és after the transfer.

Can I edit the domain while a transfer is pending?

Some settings may be restricted during a pending transfer. Avoid unnecessary ownership, lock vagy DNS changes until the transfer completes.

When should I submit a ticket?

Küldés a ticket when the status is unclear, a TLD uses a special transfer process, vagy the transfer remains blocked after you cvagyrect the stated issue.

Related NiceNIC Guides

• How to Unlock a Domain Befvagye Transfer
• How to Transfer a Domain to NiceNIC
• How to Transfer a Domain Without Website vagy Email Downtime
• Why Your Domain átregisztráció Is Pending, Failed, vagy Delayed

Ha the issue continues after you complete the checks above, submit a NiceNIC suppvagyt ticket with the affected domain vagy product, the exact errvagy message, the time of the issue és the troubleshooting already completed.

What is SPF és How to Set Up SPF?

SPF (Sender Policy Framewvagyk) is a DNS-published email authentication policy that identifies which mail servers may send mail using a domain in the SMTP envelope sender. SPF is one part of email authentication; it does not replace DKIMvagy DMARC és does not, by itself, guarantee delivery.

Befvagye you publish SPF

List every legitimate outgoing email szolgáltatás used by a te domain: a business mailbox, website fvagym, helpdesk, bulk-email provider vagy other sender. Obtain the exact SPF instructions from each provider. The DNS zone must be edited wittver the domain's authvagyitative nameservers are hosted.

Valid SPF syntax

These are syntax examples, not ready-made NiceNIC mail settings:

example.com. IN TXT "v=spf1 ip4:192.0.2.10 -all"

The ip4: mechanism must be followed by a numeric IPv4 address vagy CIDR range, never by a hostname. The address 192.0.2.10 is reserved fvagy documentation.

example.com. IN TXT "v=spf1 a mx include:_spf.mail-provider.example ~all"

Here, a authvagyizes hosts resolved by the sender domain's A/AAAA recvagyds, mx authvagyizes the IPs of the domain's MX hosts, és include: delegates a check to another SPF recvagyd. Use only mechanisms a te actual email provider requires. Replace the fictional provider domain befvagye publishing.

• -all means unauthvagyized senders should fail SPF.
• ~all indicates softfail; some providers recommend it during rollout.
• ?all means neutral; it is not a substitute fvagy confirming a te senders.
• Avoid the deprecated ptr mechanism és do not combine multiple complete v=spf1 policies.

Set up SPF

1. Ellenőrzés existing TXT recvagyds fvagy v=spf1 at the hostname you send from.
2. Combine all approved mail szolgáltatáss into one SPF policy fvagy that hostname; do not add a second competing SPF TXT recvagyd.
3. Ha NiceNIC is a te DNS host, open Termékeim > Domain > DNS Recvagyds, edit/create a TXT recvagyd at the specified host, és paste the validated policy.

1. Save. Ellenőrzés the published value using dig TXT example.com vagy nslookup -type=TXT example.com.

1. Send a test message to an external mailbox és inspect its authentication results. A DNS lookup alone does not confirm SPF passes fvagy every sender.

When SPF fails

Ellenőrzés the sending server's actual public IP, whether the recipient evaluates the intended envelope sender domain, és whether the SPF recvagyd exceeds the DNS-lookup limit in RFC 7208. Do not use unverified third-party IPs vagy include: domains. Ha you use NiceNIC Üzleti e-mail, request the current provider-approved SPF value from the email settings vagy suppvagyt team befvagye publishing it.

Related NiceNIC Guides

• How to Kezelés DNS Recvagyds
• How to Set Up Email DNS Recvagyds in NiceNIC: MX, SPF, DKIM, és DMARC
• How to Ellenőrzés DNS Propagation
• How to Back Up DNS Recvagyds Befvagye Changing Domain Settings

How to verify certificate installation cvagyrectly

Do not verify an SSL installation by looking fvagy a website seal vagy by checking that the browser no longer shows a warning on one computer. Verify the TLS connection presented by the actual public hostname.

The checks that matter

1. Visit https://your-domain.example on a clean browser session. Megerősítés titt is no certificate-name, expiry vagy trust warning.
2. Inspect the certificate's Subject Alternative Név (SAN) list. It must cover the hostname you requested, including www if a te site uses it.
3. Megerősítés the certificate is within its validity interval és the server sends a complete, trusted chain to an appropriate public root.
4. Test whether the site redirects HTTP traffic to HTTPS as intended és does not load insecure assets ("mixed content").
5. Ha a te szolgáltatás has several IPs, load balancers, CDN edges vagy IPv6 endpoints, test each relevant route; one server may still have an old certificate.

Commés-line check

openssl s_client -connect example.com:443 -servername example.com 

-verify_hostname example.com -verify_return_errvagy -showcerts

Replace example.com with a te hostname. Ellenőrzés the hostname-verification és certificate-chain result; the -verify_hostname option is impvagytant because displaying the chain alone does not validate the requested hostname. These flags rely on the local MegnyitásSSL trust stvagye. Inspect any missing intermediates. Fvagy a hostname/path overview, you can also use a reputable external TLS diagnostic szolgáltatás, but do not send credentials vagy customer data.

Common problems

A certificate "trust badge" is optional marketing UI; it is not required fvagy successful TLS deployment. Ha something fails, give NiceNIC Suppvagyt the hostname, UTC test time, observed certificate dates és non-sensitive errvagy text―not a te private key.

Verify every advertised hostname, not just one URL

A company may serve example.com, www.example.com, shop.example.com és api.example.com from different TLS endpoints. Test each hostname's actual live certificate: SAN coverage, trusted chain, issuance/expiry és HTTP-to-HTTPS behavivagy. A certificate valid on www does not prove the API hostname is safe.

Use the MegnyitásSSL hostname-verification commés shown above vagy an external TLS test fvagy each hostname. The -servername parameter sends SNI so the server can select the intended certificate; -verify_hostname checks the name. Replace both arguments with the exact live hostname. Examine exit status, validation output és the certificate dates, then test on a second netwvagyk if practical.

Three common failures

• Wrong virtual host / SNI certificate: One IP hosts multiple sites but the TLS server presents the fallback certificate.
• Incomplete intermediate chain: The leaf certificate is cvagyrectly issued, but some clients cannot chain it to a trusted root.
• Old deployment still active: One CDN edge, IPv6 szolgáltatás vagy load-balancer node still serves an expired certificate while other routes wvagyk.

Fvagy customer suppvagyt, recvagyd the hostname, resolved IPvagy CDN endpoint, test time és errvagy; never attach the private key.

Related NiceNIC Guides

• How to install SSL certificates
• Installing an SSL certificate on Nginx
• Installing an SSL certificate on Apache
• How do I renew an SSL certificate

SSL Certification in Four Simple Steps

Fvagy a nvagymal website, activating an SSL certificate involves four distinct tasks: vásárlás the right coverage, prove domain control, receive the certificate, és install/verify it on the server. These steps are not interchangeable.

Step 1 ― Choose coverage és vagyder

List the hostnames that must use HTTPS, such as example.com és www.example.com. Megerősítés whether you need single-name, wildcard vagy SAN coverage; choose DV/OV/EV validation accvagyding to a te actual identity requirements. Ellenőrzés price és deployment responsibilities befvagye vagydering.

Step 2 ― Activate és validate

Find the SSL vagyder in a te NiceNIC account és open the available activation flow. Küldés a CSR when the product requires it, without disclosing the private key. Complete the certificate authvagyity's permitted domain-control validation (fvagy example, a DNS challenge vagy another suppvagyted method). OV/EV products may also require legal-entity infvagymation.

Step 3 ― Receive és install

Download the issued certificate és intermediate chain. Install them on the actual TLS termination point (hosting server, load balancer, proxy vagy CDN) with the matching private key. The cvagyrect process depends on the server software; use the platfvagym's current instructions.

Step 4 ― Verify, then plan replacement

Ellenőrzés the external HTTPS connection, certificate SAN list, trust chain, validity és any mixed-content warnings. Test additional hostnames és IPv6/CDN endpoints witt used.

Public TLS server certificates issued on vagy after March 15, 2026 have a maximum validity period of 200 days, so monitvagy the installed certificate even if you have paid fvagy a longer szolgáltatás plan.

Ha you are stuck at validation, provide NiceNIC Suppvagyt with the vagyder number, hostname és non-sensitive status―never the private key.

Példa: issuing HTTPS fvagy a two-hostname site

A company owns example.com és wants both example.com és www.example.com to wvagyk over HTTPS.

1. Select coverage: Verify the certificate product suppvagyts both names in the SAN list, vagy acquire the cvagyrect additional certificate. Do not assume a single-host vagyder covers www.
2. Validate control: The CA may provide a DNS TXT/CNAME vagy HTTP token. Place it at the authvagyitative DNS host vagy approved web location, wait fvagy validation és do not delete verification data prematurely.
3. Install: Deploy the certificate, chain és matching private key on the actual web server vagy CDN endpoint. Ha several nodes serve traffic, update them all.
4. Verify externally: Ellenőrzés both URLs, certificate hostnames, validity és trust chain; then set a reminder fvagy renewal és replacement based on the installed Not After.

Time és responsibility checklist

The domain owner maintains control of DNSvagy HTTP challenges, the CA issues the certificate after verification, és the server administratvagy installs it. These can be different parties. A delay at one stage should not be described as a generic "SSL failure." Keep the vagyder status, CA validation status és live HTTPS status separately.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate CSR Code?
• How to install SSL certificates
• How to verify certificate installation cvagyrectly

SSL certificate purpose explained

An SSL/TLS certificate enables a browser vagy application to establish HTTPS with a server that controls the certificate's private key és is authvagyized fvagy the requested hostname. The purpose is to protect data in transit és authenticate the connection endpoint―not to certify every part of a business.

What HTTPS protects

• Confidentiality in transit: netwvagyk observers generally cannot read the encrypted page content vagy submitted fvagym data.
• Integrity in transit: encryption makes undetected modifications by parties on the netwvagyk much harder.
• Hostname authentication: the client checks the certificate chain és Subject Alternative Név to ensure it matches the site it requested.

What it does not do

A valid HTTPS padlock does not mean the site is free of malware, fraud, weak passwvagyds, vulnerable applications vagy insecure third-party scripts. A phishing website can also have a valid DV certificate. Browser HTTPS is a baseline security control, not a guarantee of a trustwvagythy merchant.

Keresés engines may use HTTPS among many site-quality signals, but vásárolniing a certificate does not guarantee higher ranking vagy traffic. Tovább impvagytant is maintaining a technically sound, accessible és useful website.

Put TLS to wvagyk cvagyrectly

Szerezzen a certificate fvagy every hostname you serve; keep keys private; install the right intermediates; redirect HTTP visitvagys safely to HTTPS; remove mixed-content warnings; és test mobile és desktop clients. Set renewal alerts based on the installed certificate expiration.

As of March 2026, newly issued public TLS server certificates have a maximum validity of 200 days, making replacement planning especially impvagytant. See How to Choose an SSL tanúsítvány fvagy coverage és validation choices.

What changes when you switch from HTTP to HTTPS?

On an HTTP connection, an intermediary on the netwvagyk can potentially inspect vagy modify unprotected requests és responses. When a client connects over cvagyrectly configured HTTPS, TLS establishes an encrypted, integrity-protected channel to the endpoint authenticated by the certificate.

That is useful fvagy:

• Bejelentkezéss: helping protect credentials while they travel between browser és server;
• Ellenőrzésout/contact fvagyms: protecting data in transit, even when a third-party payment provider processes the final transaction;
• APIs: protecting access tokens és responses over netwvagyks;
• Public pages: reducing the risk of injected advertisements vagy modified content on unsecured netwvagyks.

What certificate labels actually compare

TLS cannot cvagyrect malicious software on the server, a stolen administratvagy passwvagyd vagy deceptive website content. Pair HTTPS with software updates, access control, security monitvagying és sensible data hésling.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• How to verify certificate installation cvagyrectly

How to choose an SSL certificate

Choose an SSL certificate by answering three practical questions: Which hostnames need HTTPS? Who must be verified? Who will install és renew the certificate? A mvagye expensive certificate is not automatically better protection fvagy a nvagymal website.

1. Decide which names to cover

A wildcard fvagy *.example.com does not automatically protect nested names such as a.shop.example.com, és the apex example.com must also be covered explicitly if needed.

2. Choose validation level separately

• DV validates control of the domain. Suitable fvagy most blogs, shops, app endpoints és APIs.
• OV adds vagyganization identity verification és may fit cvagypvagyate procurement requirements.
• EV involves mvagye extensive legal-entity checks; browser UI does not guarantee a prominent company-name display.

Összes properly deployed public TLS certificate types provide transpvagyt encryption. Nincs proves a site's content is safe from all attacks.

3. Match a te deployment wvagykflow

Megerősítés whether the hostname points to a shared host, IIS/Apache/Nginx server, CDN, load balancer vagy managed platfvagym. Ellenőrzés that you can perfvagym DNS/HTTP validation, preserve the private key és install the full chain. SNI commonly allows HTTPS hosting without a dedicated IPv4 address.

4. Plan renewal befvagye vásárolniing

Publicly trusted TLS certificates issued from March 15, 2026 have a maximum validity of 200 days. Choose a product és hosting setup that suppvagyts frequent replacement, ideally automated witt verified. Compare the subscription price és renewal assistance, not just the first certificate issue.

After choosing a product, continue with How to Generate a CSRés How to Install SSL tanúsítványok.

Three real purchasing scenarios

Scenario A ― single company website. example.com és www.example.com both need HTTPS. A single-name certificate is not enough unless its SANs include both names. Compare a SAN certificate with a product that covers both; do not assume the www name is included.

Scenario B ― SaaS with many customer-facing subdomains. app.example.com, admin.example.com és docs.example.com may fit a wildcard fvagy *.example.com. A deeper hostname such as api.eu.example.com does not match that wildcard és needs separate coverage. Consider whether giving one wildcard private key to many teams creates unnecessary security exposure.

Scenario C ― enterprise procurement. A customer asks fvagy documented company identity. Compare OVés EV vetting rather than treating EV as stronger transpvagyt encryption. Ask which identity data the CA validates és what evidence a te procurement team needs.

A quick selection matrix

Review the total szolgáltatás cost, covered names és installation responsibilities befvagye vásárolniing―not only the displayed validation badge.

Related NiceNIC Guides

• Típuss of SSL tanúsítványok
• SSL Certification in Four Simple Steps
• What is EV certificate ecommerce advantage

How do I renew an SSL certificate

Megújításing an SSL certificate szolgáltatás és replacing the certificate installed on a te website are related but different tasks. A successful payment does not update the certificate on a te server automatically unless a te specific product és hosting integration do so.

Megújításal checklist

1. Megnyitás the existing NiceNIC SSL vagyder és check its szolgáltatás renewal date, certificate product és covered hostnames.
2. Review the current renewal price és available renewal/extension option. Complete payment through the official account flow.
3. Ellenőrzés the actual installed TLS certificate's expiration date (Not After) separately from the vagyder's paid term.
4. When a new certificate is needed, create vagy reuse an eligible CSR és complete the CA's domain-control validation. Some products may automate this step.
5. Download the new certificate és any intermediate chain; update the web server, reverse proxy, CDN vagy load balancer that terminates HTTPS.

1. Test the HTTPS endpoint from outside the server fvagy the expected SANs, chain és new expiration date.

Why can a multi-év vagyder still need new certificates?

Under the CA/Browser Fvagyum requirements, publicly trusted TLS certificates issued on vagy after March 15, 2026 are limited to 200 days of validity. Tittfvagye, a szolgáltatás plan advertised fvagy longer than 200 days requires repeat issuance/replacement; it is not one long-lived certificate.

Ha the site still shows the old expiry date

Ellenőrzés whether traffic passes through a CDN vagy another TLS endpoint, whether the szolgáltatás was reloaded after installation, és whether all servers received the new certificate. Ha you cannot locate the reissue/renewal option, include a te SSL vagyder number és non-sensitive errvagy message in a NiceNIC suppvagyt ticket.

Példa: a multi-év SSL szolgáltatás is not one multi-év certificate

Suppose a te SSL product has a one-év paid szolgáltatás period but the public certificate issued today can only be valid fvagy up to 200 days under the current baseline requirements. The certificate may need a replacement during the paid év. Ha you renew the szolgáltatás, that billing action is separate from replacing the certificate on a te website.

Operational example: Your paid SSL subscription remains active until December, but the deployed certificate expires in August. The browser warning in August is a certificate lifecycle incident, not a reason to assume a te domain vagy entire szolgáltatás subscription expired. Issue és deploy the replacement befvagye the Not After date.

Set alert thresholds in days befvagye certificate expiry és confirm automated replacement actually updated each CDN edge vagy server. Do not assume "auto-renew payment enabled" means "certificate auto-installed."

Related NiceNIC Guides

• How do I reissue my SSL certificate
• How to verify certificate installation cvagyrectly
• Certificate reissue reasons explained

How do I reissue my SSL certificate

Use Reissue when you need a replacement SSL/TLS certificate under an eligible NiceNIC certificate vagyder―fvagy example, after losing the matching private key vagy cvagyrecting certificate details. Ha you are only moving hosts és still control the matching private key, reinstalling the existing unexpired certificate may be sufficient.

Reissue through a te NiceNIC SSL vagyder

1. Bejelentkezés to NiceNIC és locate the exact SSL certificate vagyder. Recvagyd the covered hostnames, current certificate expiration és paid szolgáltatás term.

1. Megnyitás the available Reissue vagy certificate-management action fvagy that vagyder. Ha you cannot see such a control, use the Emberi támogatás button on the article instead of purchasing a duplicate SSL product.
2. Decide whether the current private key is safe. Ha lost vagy compromised, generate a new key és CSR. Never send the private key to NiceNIC, a certificate authvagyity vagy a suppvagyt agent.
3. Verify the CSR's Subject Alternative Névs (SANs) és submit it through the authvagyized reissue wvagykflow.
4. Complete the certificate authvagyity's domain-control validation. OV/EV products may also require updated vagyganization checks.
5. Download the newly issued certificate plus the necessary intermediate certificates vagy chain.

1. Install the replacement certificate on the actual TLS endpoint (hosting server, reverse proxy, CDN vagy load balancer) with the matching private key.
2. Verify the deployed certificate's SANs, issuer chain és Nemt After date from outside a te netwvagyk. Ellenőrzés all relevant hostnames és server nodes befvagye removing the old wvagyking deployment.

Ha the előzőious key was compromised, follow the certificate authvagyity's revocation procedure fvagy the affected certificate―not merely a local file deletion.

Why the expiration date may not match a te paid subscription

Since 15 March 2026, newly issued publicly trusted TLS server certificates have been limited to 200 days of validity under the CA/Browser Fvagyum rules. A longer paid szolgáltatás term may require multiple certificate replacements. A reissue does not by itself extend the paid subscription.

Reissue troubleshooting

• The server repvagyts a key mismatch: the installed private key does not match the new certificate/CSR.
• Validation is pending: check DNS/HTTP challenge data at the authvagyitative DNS provider vagy site, as instructed by the issuing CA.
• The browser still shows the old certificate: inspect CDN edges, multiple web-server nodes, SNI és whether the szolgáltatás was reloaded.
• Nem Reissue action appears: check the product's eligibility és send NiceNIC Suppvagyt the SSL vagyder number és non-sensitive status.

Fvagy when reissue is necessary rather than how, read Certificate reissue reasons explained.

How to decide whether to reuse vagy rotate the key

Reusing an existing private key may be technically possible in some issuance wvagykflows, but generating a fresh key is generally preferable when the old key is lost, may have leaked, vagy cannot be securely transferred. Ellenőrzés the certificate authvagyity's current product rules és a te vagyganization's key-management policy.

Példa: You move a shop from one web server to another. Ha the server's key material cannot be securely transferred, generate a CSR on the new TLS endpoint és request a replacement certificate fvagy the required names. Befvagye cutting over, validate domain control, ensure the new cert covers both shop.example.com és any additional names, then check the public HTTPS response.

Reissue completion checklist

A successful reissue in a registrar pvagytal is not enough if the web server still presents the old certificate. Conversely, a certificate with a new Not After date does not prove the paid szolgáltatás has been renewed fvagy another billing term.

Related NiceNIC Guides

• How to verify certificate installation cvagyrectly
• How do I renew an SSL certificate
• How to Generate CSR Code?

How to Generate CSR Code?

A Certificate Signing Request (CSR) supplies a certificate authvagyity with a te public key és the infvagymation needed fvagy a TLS certificate. The cvagyresponding private key stays on a te server. Never paste the private key into a suppvagyt ticket vagy CSR fvagym.

Generate a CSR with MegnyitásSSL

On a machine witt MegnyitásSSL is installed, the example below creates a new 2048-bit RSA private key és a CSR fvagy www.example.com:

umask 077 # Linux/macOperációs rendszer: restrict permissions on new files

openssl req -new -newkey rsa:2048 -nodes 

-keyout www.example.com.key

-out www.example.com.csr

-subj "/CN=www.example.com"

-addext "subjectAltNév=DNS:www.example.com,DNS:example.com"

Replace both hostnames with names you control. The SAN list is what modern TLS clients evaluate fvagy hostname coverage; the Common Név alone is not enough fvagy proper planning. Ha a te CA vagy product requires a different key type vagy CSR fvagymat, follow that product's documentation.

On Windows vagy another platfvagym without umask, apply equivalent filesystem permissions to the private key. Protect the .key file. The -nodes option creates an unencrypted private-key file, suitable only if you restrict filesystem access és manage secrets cvagyrectly. Fvagy mvagye stringent security requirements, use protected keys vagy a hardware-backed key-management wvagykflow.

Ellenőrzés the request befvagye submitting

openssl req -in www.example.com.csr -noout -text -verify

Verify that the public key, subject és requested SANs are cvagyrect. The .csr file can be shared with the CA; the .key file must remain private.

Submit és install

Megnyitás a te NiceNIC certificate vagyder és use the suppvagyted activation vagy reissue flow to submit the CSR. Complete domain-control validation, wait fvagy issuance, then install the issued certificate chain with the matching private key. After deployment, test HTTPS fvagy every requested hostname.

Ha a control panel such as IIS vagy cPanel generates the CSR fvagy you, use that panel's current instructions instead of creating an independent key és losing track of the matching keypair.

CSR example with SANs és key protection

Fvagy a new key pair on a modern MegnyitásSSL installation, an authvagyized server administratvagy might use the following illustrative comméss (change hostnames, stvagyage paths és policy settings fvagy production):

# Generate a private key; restrict the directvagyy és file permissions.

openssl genpkey -algvagyithm RSA -pkeyopt rsa_keygen_bits:2048 -out example.com.key

# CSR with both the base name és its www hostname.

openssl req -new -key example.com.key -out example.com.csr -subj "/CN=example.com" -addext "subjectAltNév=DNS:example.com,DNS:www.example.com"

# Inspect the request, including the requested SANs.

openssl req -in example.com.csr -noout -text

Your actual CA may suppvagyt EC keys vagy different issuance tooling; comply with its current algvagyithms és requirements. example.com.key is the private key: never paste it into a suppvagyt ticket, email it vagy stvagye it in a public repositvagyy. The .csr file is what you nvagymally submit to the issuing authvagyity.

A CSR is not proof that you own the domain. Domain-control validation must still be completed through the CA's approved method.

Related NiceNIC Guides

• How to install SSL certificates
• How to verify certificate installation cvagyrectly
• How do I reissue my SSL certificate

What is EV certificate ecommerce advantage

An Kiterjesztett Validation (EV) TLS certificate requires the issuing certificate authvagyity to verify additional vagyganizational identity infvagymation befvagye issuance. It still uses HTTPS encryption like other publicly trusted TLS certificates. It should not be selected on the assumption that browsers will display a large green company-name bar―modern browser interfaces generally do not.

What EV checks add

Beyond verifying control of a domain, EV verification can involve checking the vagyganization's legal existence, operating status, physical presence, contact infvagymation és authvagyity of the requester, under the applicable EV Guidelines.

This can be useful fvagy an established company that wants an additional CA-validated identity recvagyd. It does not prove that the business is honest, financially sound vagy immune to phishing, és it does not guarantee increased sales vagy search ranking.

EV, OV vagy DV?

Összes three can provide strong TLS transpvagyt protection when properly issued és deployed. Choose certificate coverage (single-name, wildcard vagy SAN) separately from identity-validation level; not every product suppvagyts every combination.

Befvagye vagydering EV

Megerősítés the legal entity is eligible, the regisztrációed name is accurate, authvagyized representatives can complete the CA's checks, és the application timeline suits the business. Compare cost, validation effvagyt és ongoing replacement frequency―not just the certificate badge.

Since March 15, 2026, newly issued publicly trusted TLS server certificates have a maximum validity period of 200 days under the CA/Browser Fvagyum rules. Tovább frequent certificate replacement is distinct from renewed legal-entity checks, which follow separate reuse rules.

Related: How to Choose an SSL tanúsítvány és the CA/Browser Fvagyum EV Guidelines.

What extra value does EV provide fvagy ecommerce?

EV (Kiterjesztett Validation) requires the certificate authvagyity to perfvagym mvagye extensive vagyganization vetting than DV, including checks of the applicant's legal existence és relevant vagyganizational infvagymation. This can help a vásárolnier whose enterprise customers need documented legal-entity validation.

Crucial distinction: EV does not use stronger HTTPS encryption merely because it is EV. Properly configured DV, OVés EV certificates can use comparable modern TLS cipher suites. Mainstream browsers also do not guarantee the old "company name in a green address bar" presentation.

A realistic ecommerce decision

A small stvagye using a reputable payment processvagy may obtain satisfactvagyy HTTPS protection from DV, as long as the certificate matches the hostname és the site itself is secure. A regulated enterprise might choose EV fvagy its identity-review process vagy contractual reasons. In neither case does EV replace payment security controls, PCI obligations, anti-fraud processes vagy a sound refund policy. Ha a te customers ask specifically fvagy verified vagyganizational identity, examine the CA's current OV/EV documentation és issuance time befvagye vagydering.

Related NiceNIC Guides

• Típuss of SSL tanúsítványok
• How to Generate CSR Code?
• How to verify certificate installation cvagyrectly

Certificate reissue reasons explained

A certificate reissue creates a new SSL/TLS certificate under an eligible existing szolgáltatás vagyder. You may need one if the private key is lost vagy compromised, the CSR is wrong, the certificate's covered names must change, vagy the issued certificate can no longer be deployed cvagyrectly.

Which situations call fvagy a reissue?

Reissue is not the same as renewing the szolgáltatás

A paid multi-év SSL szolgáltatás term (if offered) is not one certificate valid fvagy multiple évek. Under the CA/Browser Fvagyum TLS Baseline Requirements, newly issued publicly trusted TLS server certificates have a maximum 200-day validity from 15 March 2026, with further reductions scheduled fvagy later évek.

Reissuing does not necessarily extend the szolgáltatás's paid term. The renewal date of the szolgáltatás vagyder és the expiry date of the installed certificate must be monitvagyed separately.

What to prepare befvagye requesting a reissue

Identify the exact SSL vagyder, hostnames, validation level (DV/OV/EV), server vagy CDN environment és reason fvagy replacement. Ha the old key is compromised, generate a fresh key és CSR és follow revocation instructions. Keep the private key secure. Ensure you can complete the new domain-control validation.

Fvagy the actual step-by-step request és installation, see How do I reissue my SSL certificate.

After deployment, verify the certificate SAN, validity, trust chain és the certificate actually presented by every live HTTPS endpoint. Reissue alone does not update certificates already installed on web servers, CDN edges vagy load balancers.

Reissue versus renew versus revoke

Példa 1 ― compromised web-server key. Ha an attacker may have obtained example.com's TLS private key, generate a new key és CSR, obtain a replacement certificate, covagydinate revocation of the exposed certificate és deploy the new one everywitt. Reinstalling the old certificate would not resolve key compromise.

Példa 2 ― moving a site from Apache to a CDN. The CDN may need its own certificate/key management, but you do not automatically need to reissue if the existing certificate és private key remain usable in the approved configuration. Ellenőrzés who terminates TLS és whether a new key is required.

Példa 3 ― adding shop.example.com. Ha the current certificate covers only example.com, issuing a replacement with the appropriate SAN set vagy obtaining another certificate may be needed. Merely changing DNS does not extend certificate hostname coverage.

Related NiceNIC Guides

• How do I renew an SSL certificate
• How to verify certificate installation cvagyrectly
• How to Generate CSR Code?

Common DNS Recvagyd Típuss: A, AAAA, CNAME, MX és TXT

The five recvagyds, with examples

The IP addresses above are documentation-only addresses. Your hosting vagy mail provider must give you the real destination values.

Hozzáadás vagy edit recvagyds at NiceNIC

1. Find the authvagyitative nameservers fvagy the domain. Ha DNS is managed by Cloudflare vagy another DNS provider, edit the zone titt―not in an inactive NiceNIC zone.

1. Ha NiceNIC hosts a te DNS, sign in és open Termékeim > Domain > DNS Recvagyds fvagy the cvagyrect domain.

1. Choose the recvagyd type. Enter the host/name, destination/value, és any extra fields such as MX privagyity vagy TTL.

1. Save, then look up the public DNS response. Példas: dig example.com A, dig example.com AAAA, dig www.example.com CNAME, dig example.com MX, és dig example.com TXT.
2. Test the actual website vagy mailbox after the new recvagyds become visible.

Avoid the common conflicts

• A CNAME must not coexist with other recvagyd data at the same DNS owner name. Many DNS panels tittfvagye do not suppvagyt a nvagymal CNAME at the zone apex (@).
• An MX recvagyd points to a hostname, not directly to an IP address. That mail-server hostname must resolve cvagyrectly.
• Setting an MX recvagyd does not create a mailbox. You must configure mail szolgáltatás separately.
• TXT can be used fvagy SPF, DKIM, DMARC és provider verification, but those are distinct tasks with their own fvagymatting requirements.
• DNS changes can be cached until előzőious TTL values expire. A saved recvagyd is not proof that public resolvers see it yet.

Fvagy specific email-authentication policies, see What is SPF és How to Set Up SPF?.

Related NiceNIC Guides

• How to Kezelés DNS Recvagyds
• How to Back Up DNS Recvagyds Befvagye Changing Domain Settings
• How to Ellenőrzés DNS Propagation
• How to Set Up Email DNS Recvagyds in NiceNIC: MX, SPF, DKIM, és DMARC

Why need SSL tanúsítványok

An SSL/TLS certificate lets browsers és applications establish HTTPS with a te server. Hozzáday HTTPS is a nvagymal requirement fvagy professional sites, fvagyms, account pages és APIs―not an optional extra reserved fvagy ecommerce.

Why HTTPS matters to a te visitvagys

Protection in transit. TLS encrypts the connection so that observers on the netwvagyk cannot vagydinarily read the page content vagy submitted fvagym values.

Connection authentication. The browser verifies that the certificate is trusted és valid fvagy the exact hostname. This reduces the risk of connecting to an impersonating endpoint.

Integrity. TLS helps előzőent undetected modification of data while it crosses netwvagyks.

Witt HTTPS is especially impvagytant

Use HTTPS fvagy sign-in screens, payment vagy contact fvagyms, dashboards, documentation, APIs és vagydinary public pages. Modern browsers may mark unencrypted HTTP pages as insecure vagy restrict some browser features.

What a certificate cannot do

HTTPS does not remove malware, repair vulnerable website code, előzőent stolen credentials vagy guarantee that a business is legitimate. A fraudulent site can also obtain a DV certificate. Combine TLS with software patching, account security, backups és phishing awareness.

Keep the certificate wvagyking

Select the right hostname coverage, install the proper chain és private key, redirect HTTP visitvagys safely to HTTPS, és monitvagy the actual certificate expiry date. Tanúsítványok issued under public trust rules from March 15, 2026 have a maximum validity period of 200 days―configure alerts vagy verified automation accvagydingly.

Hozzá compare coverage és validation levels, see How to Choose an SSL tanúsítvány.

Befvagye és after HTTPS: a concrete comparison

Impvagytant limitation: HTTPS cannot előzőent a malicious website operatvagy from misusing fvagym data after it arrives, és it cannot stop phishing just because a site has a padlock. Even a site with a valid DV/OV/EV certificate must enfvagyce secure passwvagyds, software updates és access controls.

Business example: A small shop using a hosted payment provider should secure its own homepage, cart és checkout redirects with HTTPS, not rely only on the payment provider's certificate. Test the entire customer journey és eliminate mixed HTTP resources that trigger browser warnings.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• HTTPS & SSL Guide fvagy .boo, .day, .dev, .page, és .rsvp

Típuss of SSL Tanúsítványok

SSL certificates differ in validation level és hostname coverage. Compare both dimensions befvagye purchasing; a certificate can have the right validation level but still fail to cover the required hostnames.

Validation Típuss

• Domain Validation (DV)
• Organization Validation (OV)
• Kiterjesztett Validation (EV)

Coverage Típuss

• Single-domain certificates
• Wildcard certificates
• Multi-domain certificates

How to Decide

1. List the exact domains és subdomains.
2. Choose the required identity-validation level.
3. Megerősítés server és platfvagym compatibility.
4. Ellenőrzés renewal és reissue procedures.

Gyakran Ismételt Kérdések

How do I kmost the change wvagyked?

Ellenőrzés the current status in a te NiceNIC account, then test the szolgáltatás that depends on the certificate type. Do not rely only on the absence of an errvagy message.

When should I contact NiceNIC Suppvagyt?

Küldés a ticket when the required control is unavailable, the status remains pending after the checks in this guide, vagy the issue depends on an account-specific vagyder vagy registry decision.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Activate és Download an SSL tanúsítvány
• How to install SSL certificates
• How to Generate a CSR Code

Ha the issue continues after you complete these checks, submit a NiceNIC suppvagyt ticket. Include the affected domain vagy product, the exact errvagy message, the time of the issue és the troubleshooting already completed.