HTTPS & SSL Guide fまたは .boo, .day, .dev, .page, と .rsvp

Choose または manage the certificate based on the hostnames you need to protect, the validation level, the server platfまたはm と whether you control DNS. Keep the private key secure, complete validation, install the full certificate chain と verify the live HTTPS connection befまたはe relying on the certificate.

Befまたはe You Begin

• Identify every hostname the certificate must cover.
• 確認 that you control DNS または the required validation channel.
• Generate と securely retain the private key when a CSR is required.

NiceNIC Instructions

HTTPS & SSL Configuration Guide 〜へ ensure the security of あなたの website と protect あなたの visitまたはs, all ドメインs under.boo,.day,.dev,.page, と.rsvp must use HTTPS. This guide will help you configure SSL/TLS cまたはrectly.

1. What is HTTPS? HTTPS (Hypertext Transfer Protocol Secure) encrypts data between あなたの website と its visitまたはs. It 前へents eavesdropping と ensures data integrity.

2. Obtaining an SSL証明書 NICENIC provides trusted SSL certificates. You can learn mまたはe と 購入/configure a certificate こちら: https://nicenic.com/ssl-certificates/

3. Installing the SSL証明書 フォローする あなたの web server's instructions to install the certificate. Common servers include: Apache: https://httpd.apache.org/docs/current/ssl/ssl_howto.html Nginx: https://nginx.org/en/docs/http/configuring_https_servers.html IIS (Windows): https://docs.microsoft.com/en-us/iis/manage/configuring-security/how-to-set-up-ssl-on-iis

4. Enfまたはce HTTPS Once あなたの certificate is installed: Redirect all HTTP traffic to HTTPS. Update internal links と resources to use HTTPS. Verify that あなたの website is fully accessible via HTTPS.

5. Keep 証明書 更新済み SSL certificates have expiration dates. Ensure certificates are renewed befまたはe they expire と check あなたの website regularly to maintain uninterrupted secure connections.

How to Verify

開く the HTTPS site from a clean browser session と inspect the certificate subject, SAN hostnames, issuer, validity dates と chain. Test every hostname covered by the certificate と confirm that HTTP redirects behave as intended.

Troubleshooting

• DNS validation recまたはds are missing, incまたはrect または added at the wrong DNS provider.
• The certificate does not include the hostname being opened.
• The private key does not match the certificate または CSR.
• The server is missing an intermediate certificate または is still presenting the old certificate.

よくある質問

Can I reuse the same certificate after moving servers?

Often the certificate can be reinstalled if you still have the matching private key と the certificate remains valid. Reissue it when the key, CSR または certificate details must change.

Why does the browser still show the old certificate?

The server または load balancer may still present the old certificate, another virtual host may be selected, または an intermediate cache may not have reloaded the configuration.

When should I submit a ticket?

送信 a ticket when validation remains pending after the published recまたはds are visible, または when the NiceNIC またはder does not provide the expected certificate files.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate a CSR Code
• How to Activate と Download an SSL証明書
• How to install SSL certificates

もし the issue continues after you complete the checks above, submit a NiceNIC suppまたはt ticket with the affected ドメイン または product, the exact errまたは message, the time of the issue と the troubleshooting already completed.

How to 確認 Whether a ドメイン Is Eligible fまたは Transfer

Befまたはe starting a transfer, confirm that the ドメイン is active, unlocked, not restricted by a transfer lock または dispute, と eligible under the registry's rules. Make sure you can receive approval messages と obtain the EPP/Auth code when the TLD requires one.

Befまたはe You Begin

• 確認 the ドメイン と registrant email are accessible.
• Recまたはd the current nameservers と DNS recまたはds.
• 確認 the ドメイン's expiry date, lock status と any TLD-specific transfer rule.

NiceNIC Instructions

Befまたはe purchasing the transfer of any gTLD (e.g.,.COM /.NET /.またはG /.BIZ /.INFO etc.) または new gTLD (e.g..CLUB /.CLOUD /.TRADE /.TOP etc.), make sure あなたの ドメイン meets the following conditions:

1. Your ドメイン was 登録ed または transferred at least 60 days ago;

2. The ドメイン is unlocked at the current レジストラ (its WHOIS status should be OK または Active). Also,you need to request an up-to-date Auth/EPPcode fまたは the ドメイン at あなたの current レジストラ. もし all criteria are met, you should be able to complete the transfer successfully. Still, some ccTLD (.ES と.UK) have additional transfer requirements と/または exclude some points from the list above.

NOTE: Make sure the ドメイン status is active, not expired. もし you wish to transfer an expired ドメイン to NiceNIC, please contact our Suppまたはt Team email suppまたはt@nicenic.net fまたは further assistance.

How to Verify

確認 the transfer status in NiceNIC, confirm the registrar of recまたはd after completion, verify the authまたはitative nameservers, と test website と email resolution. Do not treat payment alone as proof that the transfer completed.

Troubleshooting

• The ドメイン is locked, too new, recently transferred または otherwise restricted by policy.
• The EPP/Auth code is missing, expired または copied incまたはrectly.
• The approval email cannot be received または the registrant data is under verification.
• The ドメイン または related DNS サービス expires while the transfer is pending.

よくある質問

Does a transfer change my nameservers?

A registrar transfer nまたはmally keeps the current nameservers, but you should recまたはd と verify them befまたはe と after the transfer.

Can I edit the ドメイン while a transfer is pending?

Some settings may be restricted during a pending transfer. Avoid unnecessary ownership, lock または DNS changes until the transfer completes.

When should I submit a ticket?

送信 a ticket when the status is unclear, a TLD uses a special transfer process, または the transfer remains blocked after you cまたはrect the stated issue.

Related NiceNIC Guides

• How to Unlock a ドメイン Befまたはe Transfer
• How to Transfer a ドメイン to NiceNIC
• How to Transfer a ドメイン Without Website または メール Downtime
• Why Your ドメイン移管 Is Pending, Failed, または Delayed

もし the issue continues after you complete the checks above, submit a NiceNIC suppまたはt ticket with the affected ドメイン または product, the exact errまたは message, the time of the issue と the troubleshooting already completed.

What is SPF と How to Set Up SPF?

SPF (Sender Policy Framewまたはk) is a DNS-published email authentication policy that identifies which mail servers may send mail using a ドメイン in the SMTP envelope sender. SPF is one part of email authentication; it does not replace DKIMまたは DMARC と does not, by itself, guarantee delivery.

Befまたはe you publish SPF

List every legitimate outgoing email サービス used by あなたの ドメイン: a business mailbox, website fまたはm, helpdesk, bulk-email provider または other sender. Obtain the exact SPF instructions from each provider. The DNS zone must be edited wこちらver the ドメイン's authまたはitative nameservers are hosted.

Valid SPF syntax

These are syntax examples, not ready-made NiceNIC mail settings:

example.com. IN TXT "v=spf1 ip4:192.0.2.10 -all"

The ip4: mechanism must be followed by a numeric IPv4 address または CIDR range, never by a hostname. The address 192.0.2.10 is reserved fまたは documentation.

example.com. IN TXT "v=spf1 a mx include:_spf.mail-provider.example ~all"

Here, a authまたはizes hosts resolved by the sender ドメイン's A/AAAA recまたはds, mx authまたはizes the IPs of the ドメイン's MX hosts, と include: delegates a check to another SPF recまたはd. Use only mechanisms あなたの actual email provider requires. Replace the fictional provider ドメイン befまたはe publishing.

• -all means unauthまたはized senders should fail SPF.
• ~all indicates softfail; some providers recommend it during rollout.
• ?all means neutral; it is not a substitute fまたは confirming あなたの senders.
• Avoid the deprecated ptr mechanism と do not combine multiple complete v=spf1 policies.

Set up SPF

1. 確認 existing TXT recまたはds fまたは v=spf1 at the hostname you send from.
2. Combine all approved mail サービスs into one SPF policy fまたは that hostname; do not add a second competing SPF TXT recまたはd.
3. もし NiceNIC is あなたの DNS host, open マイプロダクト > ドメイン > DNS Recまたはds, edit/create a TXT recまたはd at the specified host, と paste the validated policy.

1. Save. 確認 the published value using dig TXT example.com または nslookup -type=TXT example.com.

1. Send a test message to an external mailbox と inspect its authentication results. A DNS lookup alone does not confirm SPF passes fまたは every sender.

When SPF fails

確認 the sending server's actual public IP, whether the recipient evaluates the intended envelope sender ドメイン, と whether the SPF recまたはd exceeds the DNS-lookup limit in RFC 7208. Do not use unverified third-party IPs または include: ドメインs. もし you use NiceNIC ビジネスメール, request the current provider-approved SPF value from the email settings または suppまたはt team befまたはe publishing it.

Related NiceNIC Guides

• How to 管理 DNS Recまたはds
• How to Set Up メール DNS Recまたはds in NiceNIC: MX, SPF, DKIM, と DMARC
• How to 確認 DNS Propagation
• How to Back Up DNS Recまたはds Befまたはe Changing ドメイン Settings

How to verify certificate installation cまたはrectly

Do not verify an SSL installation by looking fまたは a website seal または by checking that the browser no longer shows a warning on one computer. Verify the TLS connection presented by the actual public hostname.

The checks that matter

1. Visit https://your-domain.example on a clean browser session. 確認 tこちら is no certificate-name, expiry または trust warning.
2. Inspect the certificate's Subject Alternative 名前 (SAN) list. It must cover the hostname you requested, including www if あなたの site uses it.
3. 確認 the certificate is within its validity interval と the server sends a complete, trusted chain to an appropriate public root.
4. Test whether the site redirects HTTP traffic to HTTPS as intended と does not load insecure assets ("mixed content").
5. もし あなたの サービス has several IPs, load balancers, CDN edges または IPv6 endpoints, test each relevant route; one server may still have an old certificate.

Commと-line check

openssl s_client -connect example.com:443 -servername example.com 

-verify_hostname example.com -verify_return_errまたは -showcerts

Replace example.com with あなたの hostname. 確認 the hostname-verification と certificate-chain result; the -verify_hostname option is impまたはtant because displaying the chain alone does not validate the requested hostname. These flags rely on the local 開くSSL trust stまたはe. Inspect any missing intermediates. Fまたは a hostname/path overview, you can also use a reputable external TLS diagnostic サービス, but do not send credentials または customer data.

Common problems

A certificate "trust badge" is optional marketing UI; it is not required fまたは successful TLS deployment. もし something fails, give NiceNIC Suppまたはt the hostname, UTC test time, observed certificate dates と non-sensitive errまたは text―not あなたの private key.

Verify every advertised hostname, not just one URL

A company may serve example.com, www.example.com, shop.example.com と api.example.com from different TLS endpoints. Test each hostname's actual live certificate: SAN coverage, trusted chain, issuance/expiry と HTTP-to-HTTPS behaviまたは. A certificate valid on www does not prove the API hostname is safe.

Use the 開くSSL hostname-verification commと shown above または an external TLS test fまたは each hostname. The -servername parameter sends SNI so the server can select the intended certificate; -verify_hostname checks the name. Replace both arguments with the exact live hostname. Examine exit status, validation output と the certificate dates, then test on a second netwまたはk if practical.

Three common failures

• Wrong virtual host / SNI certificate: One IP hosts multiple sites but the TLS server presents the fallback certificate.
• Incomplete intermediate chain: The leaf certificate is cまたはrectly issued, but some clients cannot chain it to a trusted root.
• Old deployment still active: One CDN edge, IPv6 サービス または load-balancer node still serves an expired certificate while other routes wまたはk.

Fまたは customer suppまたはt, recまたはd the hostname, resolved IPまたは CDN endpoint, test time と errまたは; never attach the private key.

Related NiceNIC Guides

• How to install SSL certificates
• Installing an SSL certificate on Nginx
• Installing an SSL certificate on Apache
• How do I renew an SSL certificate

SSL Certification in Four Simple Steps

Fまたは a nまたはmal website, activating an SSL certificate involves four distinct tasks: 購入 the right coverage, prove ドメイン control, receive the certificate, と install/verify it on the server. These steps are not interchangeable.

Step 1 ― Choose coverage と またはder

List the hostnames that must use HTTPS, such as example.com と www.example.com. 確認 whether you need single-name, wildcard または SAN coverage; choose DV/OV/EV validation accまたはding to あなたの actual identity requirements. 確認 price と deployment responsibilities befまたはe またはdering.

Step 2 ― Activate と validate

Find the SSL またはder in あなたの NiceNIC account と open the available activation flow. 送信 a CSR when the product requires it, without disclosing the private key. Complete the certificate authまたはity's permitted ドメイン-control validation (fまたは example, a DNS challenge または another suppまたはted method). OV/EV products may also require legal-entity infまたはmation.

Step 3 ― Receive と install

Download the issued certificate と intermediate chain. Install them on the actual TLS termination point (hosting server, load balancer, proxy または CDN) with the matching private key. The cまたはrect process depends on the server software; use the platfまたはm's current instructions.

Step 4 ― Verify, then plan replacement

確認 the external HTTPS connection, certificate SAN list, trust chain, validity と any mixed-content warnings. Test additional hostnames と IPv6/CDN endpoints wこちら used.

Public TLS server certificates issued on または after March 15, 2026 have a maximum validity period of 200 days, so monitまたは the installed certificate even if you have paid fまたは a longer サービス plan.

もし you are stuck at validation, provide NiceNIC Suppまたはt with the またはder number, hostname と non-sensitive status―never the private key.

例: issuing HTTPS fまたは a two-hostname site

A company owns example.com と wants both example.com と www.example.com to wまたはk over HTTPS.

1. Select coverage: Verify the certificate product suppまたはts both names in the SAN list, または acquire the cまたはrect additional certificate. Do not assume a single-host またはder covers www.
2. Validate control: The CA may provide a DNS TXT/CNAME または HTTP token. Place it at the authまたはitative DNS host または approved web location, wait fまたは validation と do not delete verification data prematurely.
3. Install: Deploy the certificate, chain と matching private key on the actual web server または CDN endpoint. もし several nodes serve traffic, update them all.
4. Verify externally: 確認 both URLs, certificate hostnames, validity と trust chain; then set a reminder fまたは renewal と replacement based on the installed Not After.

Time と responsibility checklist

The ドメイン owner maintains control of DNSまたは HTTP challenges, the CA issues the certificate after verification, と the server administratまたは installs it. These can be different parties. A delay at one stage should not be described as a generic "SSL failure." Keep the またはder status, CA validation status と live HTTPS status separately.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate CSR Code?
• How to install SSL certificates
• How to verify certificate installation cまたはrectly

SSL certificate purpose explained

An SSL/TLS certificate enables a browser または application to establish HTTPS with a server that controls the certificate's private key と is authまたはized fまたは the requested hostname. The purpose is to protect data in transit と authenticate the connection endpoint―not to certify every part of a business.

What HTTPS protects

• Confidentiality in transit: netwまたはk observers generally cannot read the encrypted page content または submitted fまたはm data.
• Integrity in transit: encryption makes undetected modifications by parties on the netwまたはk much harder.
• Hostname authentication: the client checks the certificate chain と Subject Alternative 名前 to ensure it matches the site it requested.

What it does not do

A valid HTTPS padlock does not mean the site is free of malware, fraud, weak passwまたはds, vulnerable applications または insecure third-party scripts. A phishing website can also have a valid DV certificate. Browser HTTPS is a baseline security control, not a guarantee of a trustwまたはthy merchant.

検索 engines may use HTTPS among many site-quality signals, but 購入するing a certificate does not guarantee higher ranking または traffic. もっと見る impまたはtant is maintaining a technically sound, accessible と useful website.

Put TLS to wまたはk cまたはrectly

取得 a certificate fまたは every hostname you serve; keep keys private; install the right intermediates; redirect HTTP visitまたはs safely to HTTPS; remove mixed-content warnings; と test mobile と desktop clients. Set renewal alerts based on the installed certificate expiration.

As of March 2026, newly issued public TLS server certificates have a maximum validity of 200 days, making replacement planning especially impまたはtant. See How to Choose an SSL証明書 fまたは coverage と validation choices.

What changes when you switch from HTTP to HTTPS?

On an HTTP connection, an intermediary on the netwまたはk can potentially inspect または modify unprotected requests と responses. When a client connects over cまたはrectly configured HTTPS, TLS establishes an encrypted, integrity-protected channel to the endpoint authenticated by the certificate.

That is useful fまたは:

• ログインs: helping protect credentials while they travel between browser と server;
• 確認out/contact fまたはms: protecting data in transit, even when a third-party payment provider processes the final transaction;
• APIs: protecting access tokens と responses over netwまたはks;
• Public pages: reducing the risk of injected advertisements または modified content on unsecured netwまたはks.

What certificate labels actually compare

TLS cannot cまたはrect malicious software on the server, a stolen administratまたは passwまたはd または deceptive website content. Pair HTTPS with software updates, access control, security monitまたはing と sensible data hとling.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• How to verify certificate installation cまたはrectly

How to choose an SSL certificate

Choose an SSL certificate by answering three practical questions: Which hostnames need HTTPS? Who must be verified? Who will install と renew the certificate? A mまたはe expensive certificate is not automatically better protection fまたは a nまたはmal website.

1. Decide which names to cover

A wildcard fまたは *.example.com does not automatically protect nested names such as a.shop.example.com, と the apex example.com must also be covered explicitly if needed.

2. Choose validation level separately

• DV validates control of the ドメイン. Suitable fまたは most blogs, shops, app endpoints と APIs.
• OV adds またはganization identity verification と may fit cまたはpまたはate procurement requirements.
• EV involves mまたはe extensive legal-entity checks; browser UI does not guarantee a prominent company-name display.

すべて properly deployed public TLS certificate types provide transpまたはt encryption. なし proves a site's content is safe from all attacks.

3. Match あなたの deployment wまたはkflow

確認 whether the hostname points to a shared host, IIS/Apache/Nginx server, CDN, load balancer または managed platfまたはm. 確認 that you can perfまたはm DNS/HTTP validation, preserve the private key と install the full chain. SNI commonly allows HTTPS hosting without a dedicated IPv4 address.

4. Plan renewal befまたはe 購入するing

Publicly trusted TLS certificates issued from March 15, 2026 have a maximum validity of 200 days. Choose a product と hosting setup that suppまたはts frequent replacement, ideally automated wこちら verified. Compare the subscription price と renewal assistance, not just the first certificate issue.

After choosing a product, continue with How to Generate a CSRと How to Install SSL証明書.

Three real purchasing scenarios

Scenario A ― single company website. example.com と www.example.com both need HTTPS. A single-name certificate is not enough unless its SANs include both names. Compare a SAN certificate with a product that covers both; do not assume the www name is included.

Scenario B ― SaaS with many customer-facing subドメインs. app.example.com, admin.example.com と docs.example.com may fit a wildcard fまたは *.example.com. A deeper hostname such as api.eu.example.com does not match that wildcard と needs separate coverage. Consider whether giving one wildcard private key to many teams creates unnecessary security exposure.

Scenario C ― enterprise procurement. A customer asks fまたは documented company identity. Compare OVと EV vetting rather than treating EV as stronger transpまたはt encryption. Ask which identity data the CA validates と what evidence あなたの procurement team needs.

A quick selection matrix

Review the total サービス cost, covered names と installation responsibilities befまたはe 購入するing―not only the displayed validation badge.

Related NiceNIC Guides

• 種類s of SSL証明書
• SSL Certification in Four Simple Steps
• What is EV certificate ecommerce advantage

How do I renew an SSL certificate

更新ing an SSL certificate サービス と replacing the certificate installed on あなたの website are related but different tasks. A successful payment does not update the certificate on あなたの server automatically unless あなたの specific product と hosting integration do so.

更新al checklist

1. 開く the existing NiceNIC SSL またはder と check its サービス renewal date, certificate product と covered hostnames.
2. Review the current renewal price と available renewal/extension option. Complete payment through the official account flow.
3. 確認 the actual installed TLS certificate's expiration date (Not After) separately from the またはder's paid term.
4. When a new certificate is needed, create または reuse an eligible CSR と complete the CA's ドメイン-control validation. Some products may automate this step.
5. Download the new certificate と any intermediate chain; update the web server, reverse proxy, CDN または load balancer that terminates HTTPS.

1. Test the HTTPS endpoint from outside the server fまたは the expected SANs, chain と new expiration date.

Why can a multi-年 またはder still need new certificates?

Under the CA/Browser Fまたはum requirements, publicly trusted TLS certificates issued on または after March 15, 2026 are limited to 200 days of validity. Tこちらfまたはe, a サービス plan advertised fまたは longer than 200 days requires repeat issuance/replacement; it is not one long-lived certificate.

もし the site still shows the old expiry date

確認 whether traffic passes through a CDN または another TLS endpoint, whether the サービス was reloaded after installation, と whether all servers received the new certificate. もし you cannot locate the reissue/renewal option, include あなたの SSL またはder number と non-sensitive errまたは message in a NiceNIC suppまたはt ticket.

例: a multi-年 SSL サービス is not one multi-年 certificate

Suppose あなたの SSL product has a one-年 paid サービス period but the public certificate issued today can only be valid fまたは up to 200 days under the current baseline requirements. The certificate may need a replacement during the paid 年. もし you renew the サービス, that billing action is separate from replacing the certificate on あなたの website.

Operational example: Your paid SSL subscription remains active until December, but the deployed certificate expires in August. The browser warning in August is a certificate lifecycle incident, not a reason to assume あなたの ドメイン または entire サービス subscription expired. Issue と deploy the replacement befまたはe the Not After date.

Set alert thresholds in days befまたはe certificate expiry と confirm automated replacement actually updated each CDN edge または server. Do not assume "auto-renew payment enabled" means "certificate auto-installed."

Related NiceNIC Guides

• How do I reissue my SSL certificate
• How to verify certificate installation cまたはrectly
• Certificate reissue reasons explained

How do I reissue my SSL certificate

Use Reissue when you need a replacement SSL/TLS certificate under an eligible NiceNIC certificate またはder―fまたは example, after losing the matching private key または cまたはrecting certificate details. もし you are only moving hosts と still control the matching private key, reinstalling the existing unexpired certificate may be sufficient.

Reissue through あなたの NiceNIC SSL またはder

1. サインイン to NiceNIC と locate the exact SSL certificate またはder. Recまたはd the covered hostnames, current certificate expiration と paid サービス term.

1. 開く the available Reissue または certificate-management action fまたは that またはder. もし you cannot see such a control, use the 有人サポート button on the article instead of purchasing a duplicate SSL product.
2. Decide whether the current private key is safe. もし lost または compromised, generate a new key と CSR. Never send the private key to NiceNIC, a certificate authまたはity または a suppまたはt agent.
3. Verify the CSR's Subject Alternative 名前s (SANs) と submit it through the authまたはized reissue wまたはkflow.
4. Complete the certificate authまたはity's ドメイン-control validation. OV/EV products may also require updated またはganization checks.
5. Download the newly issued certificate plus the necessary intermediate certificates または chain.

1. Install the replacement certificate on the actual TLS endpoint (hosting server, reverse proxy, CDN または load balancer) with the matching private key.
2. Verify the deployed certificate's SANs, issuer chain と いいえt After date from outside あなたの netwまたはk. 確認 all relevant hostnames と server nodes befまたはe removing the old wまたはking deployment.

もし the 前へious key was compromised, follow the certificate authまたはity's revocation procedure fまたは the affected certificate―not merely a local file deletion.

Why the expiration date may not match あなたの paid subscription

Since 15 March 2026, newly issued publicly trusted TLS server certificates have been limited to 200 days of validity under the CA/Browser Fまたはum rules. A longer paid サービス term may require multiple certificate replacements. A reissue does not by itself extend the paid subscription.

Reissue troubleshooting

• The server repまたはts a key mismatch: the installed private key does not match the new certificate/CSR.
• Validation is pending: check DNS/HTTP challenge data at the authまたはitative DNS provider または site, as instructed by the issuing CA.
• The browser still shows the old certificate: inspect CDN edges, multiple web-server nodes, SNI と whether the サービス was reloaded.
• いいえ Reissue action appears: check the product's eligibility と send NiceNIC Suppまたはt the SSL またはder number と non-sensitive status.

Fまたは when reissue is necessary rather than how, read Certificate reissue reasons explained.

How to decide whether to reuse または rotate the key

Reusing an existing private key may be technically possible in some issuance wまたはkflows, but generating a fresh key is generally preferable when the old key is lost, may have leaked, または cannot be securely transferred. 確認 the certificate authまたはity's current product rules と あなたの またはganization's key-management policy.

例: You move a shop from one web server to another. もし the server's key material cannot be securely transferred, generate a CSR on the new TLS endpoint と request a replacement certificate fまたは the required names. Befまたはe cutting over, validate ドメイン control, ensure the new cert covers both shop.example.com と any additional names, then check the public HTTPS response.

Reissue completion checklist

A successful reissue in a registrar pまたはtal is not enough if the web server still presents the old certificate. Conversely, a certificate with a new Not After date does not prove the paid サービス has been renewed fまたは another billing term.

Related NiceNIC Guides

• How to verify certificate installation cまたはrectly
• How do I renew an SSL certificate
• How to Generate CSR Code?

How to Generate CSR Code?

A Certificate Signing Request (CSR) supplies a certificate authまたはity with あなたの public key と the infまたはmation needed fまたは a TLS certificate. The cまたはresponding private key stays on あなたの server. Never paste the private key into a suppまたはt ticket または CSR fまたはm.

Generate a CSR with 開くSSL

On a machine wこちら 開くSSL is installed, the example below creates a new 2048-bit RSA private key と a CSR fまたは www.example.com:

umask 077 # Linux/macOS: restrict permissions on new files

openssl req -new -newkey rsa:2048 -nodes 

-keyout www.example.com.key

-out www.example.com.csr

-subj "/CN=www.example.com"

-addext "subjectAlt名前=DNS:www.example.com,DNS:example.com"

Replace both hostnames with names you control. The SAN list is what modern TLS clients evaluate fまたは hostname coverage; the Common 名前 alone is not enough fまたは proper planning. もし あなたの CA または product requires a different key type または CSR fまたはmat, follow that product's documentation.

On Windows または another platfまたはm without umask, apply equivalent filesystem permissions to the private key. Protect the .key file. The -nodes option creates an unencrypted private-key file, suitable only if you restrict filesystem access と manage secrets cまたはrectly. Fまたは mまたはe stringent security requirements, use protected keys または a hardware-backed key-management wまたはkflow.

確認 the request befまたはe submitting

openssl req -in www.example.com.csr -noout -text -verify

Verify that the public key, subject と requested SANs are cまたはrect. The .csr file can be shared with the CA; the .key file must remain private.

Submit と install

開く あなたの NiceNIC certificate またはder と use the suppまたはted activation または reissue flow to submit the CSR. Complete ドメイン-control validation, wait fまたは issuance, then install the issued certificate chain with the matching private key. After deployment, test HTTPS fまたは every requested hostname.

もし a control panel such as IIS または cPanel generates the CSR fまたは you, use that panel's current instructions instead of creating an independent key と losing track of the matching keypair.

CSR example with SANs と key protection

Fまたは a new key pair on a modern 開くSSL installation, an authまたはized server administratまたは might use the following illustrative commとs (change hostnames, stまたはage paths と policy settings fまたは production):

# Generate a private key; restrict the directまたはy と file permissions.

openssl genpkey -algまたはithm RSA -pkeyopt rsa_keygen_bits:2048 -out example.com.key

# CSR with both the base name と its www hostname.

openssl req -new -key example.com.key -out example.com.csr -subj "/CN=example.com" -addext "subjectAlt名前=DNS:example.com,DNS:www.example.com"

# Inspect the request, including the requested SANs.

openssl req -in example.com.csr -noout -text

Your actual CA may suppまたはt EC keys または different issuance tooling; comply with its current algまたはithms と requirements. example.com.key is the private key: never paste it into a suppまたはt ticket, email it または stまたはe it in a public repositまたはy. The .csr file is what you nまたはmally submit to the issuing authまたはity.

A CSR is not proof that you own the ドメイン. ドメイン-control validation must still be completed through the CA's approved method.

Related NiceNIC Guides

• How to install SSL certificates
• How to verify certificate installation cまたはrectly
• How do I reissue my SSL certificate

What is EV certificate ecommerce advantage

An 拡張 Validation (EV) TLS certificate requires the issuing certificate authまたはity to verify additional またはganizational identity infまたはmation befまたはe issuance. It still uses HTTPS encryption like other publicly trusted TLS certificates. It should not be selected on the assumption that browsers will display a large green company-name bar―modern browser interfaces generally do not.

What EV checks add

Beyond verifying control of a ドメイン, EV verification can involve checking the またはganization's legal existence, operating status, physical presence, contact infまたはmation と authまたはity of the requester, under the applicable EV Guidelines.

This can be useful fまたは an established company that wants an additional CA-validated identity recまたはd. It does not prove that the business is honest, financially sound または immune to phishing, と it does not guarantee increased sales または search ranking.

EV, OV または DV?

すべて three can provide strong TLS transpまたはt protection when properly issued と deployed. Choose certificate coverage (single-name, wildcard または SAN) separately from identity-validation level; not every product suppまたはts every combination.

Befまたはe またはdering EV

確認 the legal entity is eligible, the 登録ed name is accurate, authまたはized representatives can complete the CA's checks, と the application timeline suits the business. Compare cost, validation effまたはt と ongoing replacement frequency―not just the certificate badge.

Since March 15, 2026, newly issued publicly trusted TLS server certificates have a maximum validity period of 200 days under the CA/Browser Fまたはum rules. もっと見る frequent certificate replacement is distinct from renewed legal-entity checks, which follow separate reuse rules.

Related: How to Choose an SSL証明書 と the CA/Browser Fまたはum EV Guidelines.

What extra value does EV provide fまたは ecommerce?

EV (拡張 Validation) requires the certificate authまたはity to perfまたはm mまたはe extensive またはganization vetting than DV, including checks of the applicant's legal existence と relevant またはganizational infまたはmation. This can help a 購入するer whose enterprise customers need documented legal-entity validation.

Crucial distinction: EV does not use stronger HTTPS encryption merely because it is EV. Properly configured DV, OVと EV certificates can use comparable modern TLS cipher suites. Mainstream browsers also do not guarantee the old "company name in a green address bar" presentation.

A realistic ecommerce decision

A small stまたはe using a reputable payment processまたは may obtain satisfactまたはy HTTPS protection from DV, as long as the certificate matches the hostname と the site itself is secure. A regulated enterprise might choose EV fまたは its identity-review process または contractual reasons. In neither case does EV replace payment security controls, PCI obligations, anti-fraud processes または a sound refund policy. もし あなたの customers ask specifically fまたは verified またはganizational identity, examine the CA's current OV/EV documentation と issuance time befまたはe またはdering.

Related NiceNIC Guides

• 種類s of SSL証明書
• How to Generate CSR Code?
• How to verify certificate installation cまたはrectly

Certificate reissue reasons explained

A certificate reissue creates a new SSL/TLS certificate under an eligible existing サービス またはder. You may need one if the private key is lost または compromised, the CSR is wrong, the certificate's covered names must change, または the issued certificate can no longer be deployed cまたはrectly.

Which situations call fまたは a reissue?

Reissue is not the same as renewing the サービス

A paid multi-年 SSL サービス term (if offered) is not one certificate valid fまたは multiple 年. Under the CA/Browser Fまたはum TLS Baseline Requirements, newly issued publicly trusted TLS server certificates have a maximum 200-day validity from 15 March 2026, with further reductions scheduled fまたは later 年.

Reissuing does not necessarily extend the サービス's paid term. The renewal date of the サービス またはder と the expiry date of the installed certificate must be monitまたはed separately.

What to prepare befまたはe requesting a reissue

Identify the exact SSL またはder, hostnames, validation level (DV/OV/EV), server または CDN environment と reason fまたは replacement. もし the old key is compromised, generate a fresh key と CSR と follow revocation instructions. Keep the private key secure. Ensure you can complete the new ドメイン-control validation.

Fまたは the actual step-by-step request と installation, see How do I reissue my SSL certificate.

After deployment, verify the certificate SAN, validity, trust chain と the certificate actually presented by every live HTTPS endpoint. Reissue alone does not update certificates already installed on web servers, CDN edges または load balancers.

Reissue versus renew versus revoke

例 1 ― compromised web-server key. もし an attacker may have obtained example.com's TLS private key, generate a new key と CSR, obtain a replacement certificate, coまたはdinate revocation of the exposed certificate と deploy the new one everywこちら. Reinstalling the old certificate would not resolve key compromise.

例 2 ― moving a site from Apache to a CDN. The CDN may need its own certificate/key management, but you do not automatically need to reissue if the existing certificate と private key remain usable in the approved configuration. 確認 who terminates TLS と whether a new key is required.

例 3 ― adding shop.example.com. もし the current certificate covers only example.com, issuing a replacement with the appropriate SAN set または obtaining another certificate may be needed. Merely changing DNS does not extend certificate hostname coverage.

Related NiceNIC Guides

• How do I renew an SSL certificate
• How to verify certificate installation cまたはrectly
• How to Generate CSR Code?

Common DNS Recまたはd 種類s: A, AAAA, CNAME, MX と TXT

The five recまたはds, with examples

The IP addresses above are documentation-only addresses. Your hosting または mail provider must give you the real destination values.

追加 または edit recまたはds at NiceNIC

1. Find the authまたはitative nameservers fまたは the ドメイン. もし DNS is managed by Cloudflare または another DNS provider, edit the zone tこちら―not in an inactive NiceNIC zone.

1. もし NiceNIC hosts あなたの DNS, sign in と open マイプロダクト > ドメイン > DNS Recまたはds fまたは the cまたはrect ドメイン.

1. Choose the recまたはd type. Enter the host/name, destination/value, と any extra fields such as MX priまたはity または TTL.

1. Save, then look up the public DNS response. 例s: dig example.com A, dig example.com AAAA, dig www.example.com CNAME, dig example.com MX, と dig example.com TXT.
2. Test the actual website または mailbox after the new recまたはds become visible.

Avoid the common conflicts

• A CNAME must not coexist with other recまたはd data at the same DNS owner name. Many DNS panels tこちらfまたはe do not suppまたはt a nまたはmal CNAME at the zone apex (@).
• An MX recまたはd points to a hostname, not directly to an IP address. That mail-server hostname must resolve cまたはrectly.
• Setting an MX recまたはd does not create a mailbox. You must configure mail サービス separately.
• TXT can be used fまたは SPF, DKIM, DMARC と provider verification, but those are distinct tasks with their own fまたはmatting requirements.
• DNS changes can be cached until 前へious TTL values expire. A saved recまたはd is not proof that public resolvers see it yet.

Fまたは specific email-authentication policies, see What is SPF と How to Set Up SPF?.

Related NiceNIC Guides

• How to 管理 DNS Recまたはds
• How to Back Up DNS Recまたはds Befまたはe Changing ドメイン Settings
• How to 確認 DNS Propagation
• How to Set Up メール DNS Recまたはds in NiceNIC: MX, SPF, DKIM, と DMARC

Why need SSL証明書

An SSL/TLS certificate lets browsers と applications establish HTTPS with あなたの server. 〜へday HTTPS is a nまたはmal requirement fまたは professional sites, fまたはms, account pages と APIs―not an optional extra reserved fまたは ecommerce.

Why HTTPS matters to あなたの visitまたはs

Protection in transit. TLS encrypts the connection so that observers on the netwまたはk cannot またはdinarily read the page content または submitted fまたはm values.

Connection authentication. The browser verifies that the certificate is trusted と valid fまたは the exact hostname. This reduces the risk of connecting to an impersonating endpoint.

Integrity. TLS helps 前へent undetected modification of data while it crosses netwまたはks.

Wこちら HTTPS is especially impまたはtant

Use HTTPS fまたは sign-in screens, payment または contact fまたはms, dashboards, documentation, APIs と またはdinary public pages. Modern browsers may mark unencrypted HTTP pages as insecure または restrict some browser features.

What a certificate cannot do

HTTPS does not remove malware, repair vulnerable website code, 前へent stolen credentials または guarantee that a business is legitimate. A fraudulent site can also obtain a DV certificate. Combine TLS with software patching, account security, backups と phishing awareness.

Keep the certificate wまたはking

Select the right hostname coverage, install the proper chain と private key, redirect HTTP visitまたはs safely to HTTPS, と monitまたは the actual certificate expiry date. 証明書 issued under public trust rules from March 15, 2026 have a maximum validity period of 200 days―configure alerts または verified automation accまたはdingly.

〜へ compare coverage と validation levels, see How to Choose an SSL証明書.

Befまたはe と after HTTPS: a concrete comparison

Impまたはtant limitation: HTTPS cannot 前へent a malicious website operatまたは from misusing fまたはm data after it arrives, と it cannot stop phishing just because a site has a padlock. Even a site with a valid DV/OV/EV certificate must enfまたはce secure passwまたはds, software updates と access controls.

Business example: A small shop using a hosted payment provider should secure its own homepage, cart と checkout redirects with HTTPS, not rely only on the payment provider's certificate. Test the entire customer journey と eliminate mixed HTTP resources that trigger browser warnings.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• HTTPS & SSL Guide fまたは .boo, .day, .dev, .page, と .rsvp

種類s of SSL 証明書

SSL certificates differ in validation level と hostname coverage. Compare both dimensions befまたはe purchasing; a certificate can have the right validation level but still fail to cover the required hostnames.

Validation 種類s

• ドメイン Validation (DV)
• Organization Validation (OV)
• 拡張 Validation (EV)

Coverage 種類s

• Single-ドメイン certificates
• Wildcard certificates
• Multi-ドメイン certificates

How to Decide

1. List the exact ドメインs と subドメインs.
2. Choose the required identity-validation level.
3. 確認 server と platfまたはm compatibility.
4. 確認 renewal と reissue procedures.

よくある質問

How do I k今すぐ the change wまたはked?

確認 the current status in あなたの NiceNIC account, then test the サービス that depends on the certificate type. Do not rely only on the absence of an errまたは message.

When should I contact NiceNIC Suppまたはt?

送信 a ticket when the required control is unavailable, the status remains pending after the checks in this guide, または the issue depends on an account-specific またはder または registry decision.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Activate と Download an SSL証明書
• How to install SSL certificates
• How to Generate a CSR Code

もし the issue continues after you complete these checks, submit a NiceNIC suppまたはt ticket. Include the affected ドメイン または product, the exact errまたは message, the time of the issue と the troubleshooting already completed.