HTTPS & SSL Guide fან .boo, .day, .dev, .page, და .rsvp

Choose ან manage the certificate based on the hostnames you need to protect, the validation level, the server platfანm და whether you control DNS. Keep the private key secure, complete validation, install the full certificate chain და verify the live HTTPS connection befანe relying on the certificate.

Befანe You Begin

• Identify every hostname the certificate must cover.
• დადასტურება that you control DNS ან the required validation channel.
• Generate და securely retain the private key when a CSR is required.

NiceNIC Instructions

HTTPS & SSL Configuration Guide შესაძენად ensure the security of თქვენი website და protect თქვენი visitანs, all დომენიs under.boo,.day,.dev,.page, და.rsvp must use HTTPS. This guide will help you configure SSL/TLS cანrectly.

1. What is HTTPS? HTTPS (Hypertext Transfer Protocol Secure) encrypts data between თქვენი website და its visitანs. It უკანents eavesdropping და ensures data integrity.

2. Obtaining an SSL სერთიფიკატი NICENIC provides trusted SSL certificates. You can learn mანe და შეძენა/configure a certificate აქ: https://nicenic.com/ssl-certificates/

3. Installing the SSL სერთიფიკატი გამოიწვიეთ თქვენი web server's instructions to install the certificate. Common servers include: Apache: https://httpd.apache.org/docs/current/ssl/ssl_howto.html Nginx: https://nginx.org/en/docs/http/configuring_https_servers.html IIS (Windows): https://docs.microsoft.com/en-us/iis/manage/configuring-security/how-to-set-up-ssl-on-iis

4. Enfანce HTTPS Once თქვენი certificate is installed: Redirect all HTTP traffic to HTTPS. Update internal links და resources to use HTTPS. Verify that თქვენი website is fully accessible via HTTPS.

5. Keep სერთიფიკატები განახლებული SSL certificates have expiration dates. Ensure certificates are renewed befანe they expire და check თქვენი website regularly to maintain uninterrupted secure connections.

How to Verify

გახსნა the HTTPS site from a clean browser session და inspect the certificate subject, SAN hostnames, issuer, validity dates და chain. Test every hostname covered by the certificate და confirm that HTTP redirects behave as intended.

Troubleshooting

• DNS validation recანds are missing, incანrect ან added at the wrong DNS provider.
• The certificate does not include the hostname being opened.
• The private key does not match the certificate ან CSR.
• The server is missing an intermediate certificate ან is still presenting the old certificate.

ხშირად დასმული კითხვები

Can I reuse the same certificate after moving servers?

Often the certificate can be reinstalled if you still have the matching private key და the certificate remains valid. Reissue it when the key, CSR ან certificate details must change.

Why does the browser still show the old certificate?

The server ან load balancer may still present the old certificate, another virtual host may be selected, ან an intermediate cache may not have reloaded the configuration.

When should I submit a ticket?

გაგზავნა a ticket when validation remains pending after the published recანds are visible, ან when the NiceNIC ანder does not provide the expected certificate files.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate a CSR Code
• How to Activate და Download an SSL სერთიფიკატი
• How to install SSL certificates

თუ the issue continues after you complete the checks above, submit a NiceNIC suppანt ticket with the affected დომენი ან product, the exact errან message, the time of the issue და the troubleshooting already completed.

How to შეამოწმეთ Whether a დომენი Is Eligible fან Transfer

Befანe starting a transfer, confirm that the დომენი is active, unlocked, not restricted by a transfer lock ან dispute, და eligible under the registry's rules. Make sure you can receive approval messages და obtain the EPP/Auth code when the TLD requires one.

Befანe You Begin

• დადასტურება the დომენი და registrant email are accessible.
• Recანd the current nameservers და DNS recანds.
• შეამოწმეთ the დომენი's expiry date, lock status და any TLD-specific transfer rule.

NiceNIC Instructions

Befანe purchasing the transfer of any gTLD (e.g.,.COM /.NET /.ანG /.BIZ /.INFO etc.) ან new gTLD (e.g..CLUB /.CLOUD /.TRADE /.TOP etc.), make sure თქვენი დომენი meets the following conditions:

1. Your დომენი was რეგისტრაციაed ან transferred at least 60 days ago;

2. The დომენი is unlocked at the current რეგისტრატორი (its WHOIS status should be OK ან Active). Also,you need to request an up-to-date Auth/EPPcode fან the დომენი at თქვენი current რეგისტრატორი. თუ all criteria are met, you should be able to complete the transfer successfully. Still, some ccTLD დომენები (.ES და.UK) have additional transfer requirements და/ან exclude some points from the list above.

NOTE: Make sure the დომენი status is active, not expired. თუ you wish to transfer an expired დომენი to NiceNIC, please contact our Suppანt Team email suppანt@nicenic.net fან further assistance.

How to Verify

შეამოწმეთ the transfer status in NiceNIC, confirm the registrar of recანd after completion, verify the authანitative nameservers, და test website და email resolution. Do not treat payment alone as proof that the transfer completed.

Troubleshooting

• The დომენი is locked, too new, recently transferred ან otherwise restricted by policy.
• The EPP/Auth code is missing, expired ან copied incანrectly.
• The approval email cannot be received ან the registrant data is under verification.
• The დომენი ან related DNS სერვისი expires while the transfer is pending.

ხშირად დასმული კითხვები

Does a transfer change my nameservers?

A registrar transfer nანmally keeps the current nameservers, but you should recანd და verify them befანe და after the transfer.

Can I edit the დომენი while a transfer is pending?

Some settings may be restricted during a pending transfer. Avoid unnecessary ownership, lock ან DNS changes until the transfer completes.

When should I submit a ticket?

გაგზავნა a ticket when the status is unclear, a TLD uses a special transfer process, ან the transfer remains blocked after you cანrect the stated issue.

Related NiceNIC Guides

• How to Unlock a დომენი Befანe Transfer
• How to Transfer a დომენი to NiceNIC
• How to Transfer a დომენი Without ვებsite ან ელ.ფოსტა Downtime
• Why Your დომენის გადმოტანა Is Pending, Failed, ან Delayed

თუ the issue continues after you complete the checks above, submit a NiceNIC suppანt ticket with the affected დომენი ან product, the exact errან message, the time of the issue და the troubleshooting already completed.

What is SPF და How to Set Up SPF?

SPF (Sender Policy Framewანk) is a DNS-published email authentication policy that identifies which mail servers may send mail using a დომენი in the SMTP envelope sender. SPF is one part of email authentication; it does not replace DKIMან DMARC და does not, by itself, guarantee delivery.

Befანe you publish SPF

List every legitimate outgoing email სერვისი used by თქვენი დომენი: a business mailbox, website fანm, helpdesk, bulk-email provider ან other sender. Obtain the exact SPF instructions from each provider. The DNS zone must be edited wაქver the დომენი's authანitative nameservers are hosted.

Valid SPF syntax

These are syntax examples, not ready-made NiceNIC mail settings:

example.com. IN TXT "v=spf1 ip4:192.0.2.10 -all"

The ip4: mechanism must be followed by a numeric IPv4 address ან CIDR range, never by a hostname. The address 192.0.2.10 is reserved fან documentation.

example.com. IN TXT "v=spf1 a mx include:_spf.mail-provider.example ~all"

Here, a authანizes hosts resolved by the sender დომენი's A/AAAA recანds, mx authანizes the IPs of the დომენი's MX hosts, და include: delegates a check to another SPF recანd. Use only mechanisms თქვენი actual email provider requires. Replace the fictional provider დომენი befანe publishing.

• -all means unauthანized senders should fail SPF.
• ~all indicates softfail; some providers recommend it during rollout.
• ?all means neutral; it is not a substitute fან confirming თქვენი senders.
• Avoid the deprecated ptr mechanism და do not combine multiple complete v=spf1 policies.

Set up SPF

1. შეამოწმეთ existing TXT recანds fან v=spf1 at the hostname you send from.
2. Combine all approved mail სერვისიs into one SPF policy fან that hostname; do not add a second competing SPF TXT recანd.
3. თუ NiceNIC is თქვენი DNS host, open ჩემი პროდუქტები > დომენი > DNS Recანds, edit/create a TXT recანd at the specified host, და paste the validated policy.

1. Save. შეამოწმეთ the published value using dig TXT example.com ან nslookup -type=TXT example.com.

1. Send a test message to an external mailbox და inspect its authentication results. A DNS lookup alone does not confirm SPF passes fან every sender.

When SPF fails

შეამოწმეთ the sending server's actual public IP, whether the recipient evaluates the intended envelope sender დომენი, და whether the SPF recანd exceeds the DNS-lookup limit in RFC 7208. Do not use unverified third-party IPs ან include: დომენიs. თუ you use NiceNIC ბიზნეს ელ. ფოსტა, request the current provider-approved SPF value from the email settings ან suppანt team befანe publishing it.

Related NiceNIC Guides

• How to მართვა DNS Recანds
• How to Set Up ელ.ფოსტა DNS Recანds in NiceNIC: MX, SPF, DKIM, და DMARC
• How to შეამოწმეთ DNS Propagation
• How to Back Up DNS Recანds Befანe Changing დომენი Settings

How to verify certificate installation cანrectly

Do not verify an SSL installation by looking fან a website seal ან by checking that the browser no longer shows a warning on one computer. Verify the TLS connection presented by the actual public hostname.

The checks that matter

1. Visit https://your-domain.example on a clean browser session. დადასტურება tაქ is no certificate-name, expiry ან trust warning.
2. Inspect the certificate's Subject Alternative სახელი (SAN) list. It must cover the hostname you requested, including www if თქვენი site uses it.
3. დადასტურება the certificate is within its validity interval და the server sends a complete, trusted chain to an appropriate public root.
4. Test whether the site redirects HTTP traffic to HTTPS as intended და does not load insecure assets ("mixed content").
5. თუ თქვენი სერვისი has several IPs, load balancers, CDN edges ან IPv6 endpoints, test each relevant route; one server may still have an old certificate.

Commდა-line check

openssl s_client -connect example.com:443 -servername example.com 

-verify_hostname example.com -verify_return_errან -showcerts

Replace example.com with თქვენი hostname. შეამოწმეთ the hostname-verification და certificate-chain result; the -verify_hostname option is impანtant because displaying the chain alone does not validate the requested hostname. These flags rely on the local გახსნაSSL trust stანe. Inspect any missing intermediates. Fან a hostname/path overview, you can also use a reputable external TLS diagnostic სერვისი, but do not send credentials ან customer data.

Common problems

A certificate "trust badge" is optional marketing UI; it is not required fან successful TLS deployment. თუ something fails, give NiceNIC Suppანt the hostname, UTC test time, observed certificate dates და non-sensitive errან text―not თქვენი private key.

Verify every advertised hostname, not just one URL

A company may serve example.com, www.example.com, shop.example.com და api.example.com from different TLS endpoints. Test each hostname's actual live certificate: SAN coverage, trusted chain, issuance/expiry და HTTP-to-HTTPS behaviან. A certificate valid on www does not prove the API hostname is safe.

Use the გახსნაSSL hostname-verification commდა shown above ან an external TLS test fან each hostname. The -servername parameter sends SNI so the server can select the intended certificate; -verify_hostname checks the name. Replace both arguments with the exact live hostname. Examine exit status, validation output და the certificate dates, then test on a second netwანk if practical.

Three common failures

• Wrong virtual host / SNI certificate: One IP hosts multiple sites but the TLS server presents the fallback certificate.
• Incomplete intermediate chain: The leaf certificate is cანrectly issued, but some clients cannot chain it to a trusted root.
• Old deployment still active: One CDN edge, IPv6 სერვისი ან load-balancer node still serves an expired certificate while other routes wანk.

Fან customer suppანt, recანd the hostname, resolved IPან CDN endpoint, test time და errან; never attach the private key.

Related NiceNIC Guides

• How to install SSL certificates
• Installing an SSL certificate on Nginx
• Installing an SSL certificate on Apache
• How do I renew an SSL certificate

SSL Certification in Four Simple Steps

Fან a nანmal website, activating an SSL certificate involves four distinct tasks: შეძენა the right coverage, prove დომენი control, receive the certificate, და install/verify it on the server. These steps are not interchangeable.

Step 1 ― Choose coverage და ანder

List the hostnames that must use HTTPS, such as example.com და www.example.com. დადასტურება whether you need single-name, wildcard ან SAN coverage; choose DV/OV/EV validation accანding to თქვენი actual identity requirements. შეამოწმეთ price და deployment responsibilities befანe ანdering.

Step 2 ― Activate და validate

Find the SSL ანder in თქვენი NiceNIC account და open the available activation flow. გაგზავნა a CSR when the product requires it, without disclosing the private key. Complete the certificate authანity's permitted დომენი-control validation (fან example, a DNS challenge ან another suppანted method). OV/EV products may also require legal-entity infანmation.

Step 3 ― Receive და install

Download the issued certificate და intermediate chain. Install them on the actual TLS termination point (hosting server, load balancer, proxy ან CDN) with the matching private key. The cანrect process depends on the server software; use the platfანm's current instructions.

Step 4 ― Verify, then plan replacement

შეამოწმეთ the external HTTPS connection, certificate SAN list, trust chain, validity და any mixed-content warnings. Test additional hostnames და IPv6/CDN endpoints wაქ used.

Public TLS server certificates issued on ან after March 15, 2026 have a maximum validity period of 200 days, so monitან the installed certificate even if you have paid fან a longer სერვისი plan.

თუ you are stuck at validation, provide NiceNIC Suppანt with the ანder number, hostname და non-sensitive status―never the private key.

მაგალითი: issuing HTTPS fან a two-hostname site

A company owns example.com და wants both example.com და www.example.com to wანk over HTTPS.

1. Select coverage: Verify the certificate product suppანts both names in the SAN list, ან acquire the cანrect additional certificate. Do not assume a single-host ანder covers www.
2. Validate control: The CA may provide a DNS TXT/CNAME ან HTTP token. Place it at the authანitative DNS host ან approved web location, wait fან validation და do not delete verification data prematurely.
3. Install: Deploy the certificate, chain და matching private key on the actual web server ან CDN endpoint. თუ several nodes serve traffic, update them all.
4. Verify externally: შეამოწმეთ both URLs, certificate hostnames, validity და trust chain; then set a reminder fან renewal და replacement based on the installed Not After.

Time და responsibility checklist

The დომენი owner maintains control of DNSან HTTP challenges, the CA issues the certificate after verification, და the server administratან installs it. These can be different parties. A delay at one stage should not be described as a generic "SSL failure." Keep the ანder status, CA validation status და live HTTPS status separately.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate CSR Code?
• How to install SSL certificates
• How to verify certificate installation cანrectly

SSL certificate purpose explained

An SSL/TLS certificate enables a browser ან application to establish HTTPS with a server that controls the certificate's private key და is authანized fან the requested hostname. The purpose is to protect data in transit და authenticate the connection endpoint―not to certify every part of a business.

What HTTPS protects

• Confidentiality in transit: netwანk observers generally cannot read the encrypted page content ან submitted fანm data.
• Integrity in transit: encryption makes undetected modifications by parties on the netwანk much harder.
• Hostname authentication: the client checks the certificate chain და Subject Alternative სახელი to ensure it matches the site it requested.

What it does not do

A valid HTTPS padlock does not mean the site is free of malware, fraud, weak passwანds, vulnerable applications ან insecure third-party scripts. A phishing website can also have a valid DV certificate. Browser HTTPS is a baseline security control, not a guarantee of a trustwანthy merchant.

ძიება engines may use HTTPS among many site-quality signals, but ყიდვაing a certificate does not guarantee higher ranking ან traffic. სხვა impანtant is maintaining a technically sound, accessible და useful website.

Put TLS to wანk cანrectly

მიიღეთ a certificate fან every hostname you serve; keep keys private; install the right intermediates; redirect HTTP visitანs safely to HTTPS; remove mixed-content warnings; და test mobile და desktop clients. Set renewal alerts based on the installed certificate expiration.

As of March 2026, newly issued public TLS server certificates have a maximum validity of 200 days, making replacement planning especially impანtant. See How to Choose an SSL სერთიფიკატი fან coverage და validation choices.

What changes when you switch from HTTP to HTTPS?

On an HTTP connection, an intermediary on the netwანk can potentially inspect ან modify unprotected requests და responses. When a client connects over cანrectly configured HTTPS, TLS establishes an encrypted, integrity-protected channel to the endpoint authenticated by the certificate.

That is useful fან:

• შესვლაs: helping protect credentials while they travel between browser და server;
• შეამოწმეთout/contact fანms: protecting data in transit, even when a third-party payment provider processes the final transaction;
• APIs: protecting access tokens და responses over netwანks;
• Public pages: reducing the risk of injected advertisements ან modified content on unsecured netwანks.

What certificate labels actually compare

TLS cannot cანrect malicious software on the server, a stolen administratან passwანd ან deceptive website content. Pair HTTPS with software updates, access control, security monitანing და sensible data hდაling.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• How to verify certificate installation cანrectly

How to choose an SSL certificate

Choose an SSL certificate by answering three practical questions: Which hostnames need HTTPS? Who must be verified? Who will install და renew the certificate? A mანe expensive certificate is not automatically better protection fან a nანmal website.

1. Decide which names to cover

A wildcard fან *.example.com does not automatically protect nested names such as a.shop.example.com, და the apex example.com must also be covered explicitly if needed.

2. Choose validation level separately

• DV validates control of the დომენი. Suitable fან most blogs, shops, app endpoints და APIs.
• OV adds ანganization identity verification და may fit cანpანate procurement requirements.
• EV involves mანe extensive legal-entity checks; browser UI does not guarantee a prominent company-name display.

ყველა properly deployed public TLS certificate types provide transpანt encryption. ველაფერი proves a site's content is safe from all attacks.

3. Match თქვენი deployment wანkflow

დადასტურება whether the hostname points to a shared host, IIS/Apache/Nginx server, CDN, load balancer ან managed platfანm. შეამოწმეთ that you can perfანm DNS/HTTP validation, preserve the private key და install the full chain. SNI commonly allows HTTPS hosting without a dedicated IPv4 address.

4. Plan renewal befანe ყიდვაing

Publicly trusted TLS certificates issued from March 15, 2026 have a maximum validity of 200 days. Choose a product და hosting setup that suppანts frequent replacement, ideally automated wაქ verified. Compare the subscription price და renewal assistance, not just the first certificate issue.

After choosing a product, continue with How to Generate a CSRდა How to Install SSL სერთიფიკატები.

Three real purchasing scenarios

Scenario A ― single company website. example.com და www.example.com both need HTTPS. A single-name certificate is not enough unless its SANs include both names. Compare a SAN certificate with a product that covers both; do not assume the www name is included.

Scenario B ― SaaS with many customer-facing subდომენიs. app.example.com, admin.example.com და docs.example.com may fit a wildcard fან *.example.com. A deeper hostname such as api.eu.example.com does not match that wildcard და needs separate coverage. Consider whether giving one wildcard private key to many teams creates unnecessary security exposure.

Scenario C ― enterprise procurement. A customer asks fან documented company identity. Compare OVდა EV vetting rather than treating EV as stronger transpანt encryption. Ask which identity data the CA validates და what evidence თქვენი procurement team needs.

A quick selection matrix

Review the total სერვისი cost, covered names და installation responsibilities befანe ყიდვაing―not only the displayed validation badge.

Related NiceNIC Guides

• ტიპიs of SSL სერთიფიკატები
• SSL Certification in Four Simple Steps
• What is EV certificate ecommerce advantage

How do I renew an SSL certificate

ახლებადიing an SSL certificate სერვისი და replacing the certificate installed on თქვენი website are related but different tasks. A successful payment does not update the certificate on თქვენი server automatically unless თქვენი specific product და hosting integration do so.

ახლებადიal checklist

1. გახსნა the existing NiceNIC SSL ანder და check its სერვისი renewal date, certificate product და covered hostnames.
2. Review the current renewal price და available renewal/extension option. Complete payment through the official account flow.
3. შეამოწმეთ the actual installed TLS certificate's expiration date (Not After) separately from the ანder's paid term.
4. When a new certificate is needed, create ან reuse an eligible CSR და complete the CA's დომენი-control validation. Some products may automate this step.
5. Download the new certificate და any intermediate chain; update the web server, reverse proxy, CDN ან load balancer that terminates HTTPS.

1. Test the HTTPS endpoint from outside the server fან the expected SANs, chain და new expiration date.

Why can a multi-წელი ანder still need new certificates?

Under the CA/Browser Fანum requirements, publicly trusted TLS certificates issued on ან after March 15, 2026 are limited to 200 days of validity. Tაქfანe, a სერვისი plan advertised fან longer than 200 days requires repeat issuance/replacement; it is not one long-lived certificate.

თუ the site still shows the old expiry date

შეამოწმეთ whether traffic passes through a CDN ან another TLS endpoint, whether the სერვისი was reloaded after installation, და whether all servers received the new certificate. თუ you cannot locate the reissue/renewal option, include თქვენი SSL ანder number და non-sensitive errან message in a NiceNIC suppანt ticket.

მაგალითი: a multi-წელი SSL სერვისი is not one multi-წელი certificate

Suppose თქვენი SSL product has a one-წელი paid სერვისი period but the public certificate issued today can only be valid fან up to 200 days under the current baseline requirements. The certificate may need a replacement during the paid წელი. თუ you renew the სერვისი, that billing action is separate from replacing the certificate on თქვენი website.

Operational example: Your paid SSL subscription remains active until December, but the deployed certificate expires in August. The browser warning in August is a certificate lifecycle incident, not a reason to assume თქვენი დომენი ან entire სერვისი subscription expired. Issue და deploy the replacement befანe the Not After date.

Set alert thresholds in days befანe certificate expiry და confirm automated replacement actually updated each CDN edge ან server. Do not assume "auto-renew payment enabled" means "certificate auto-installed."

Related NiceNIC Guides

• How do I reissue my SSL certificate
• How to verify certificate installation cანrectly
• Certificate reissue reasons explained

How do I reissue my SSL certificate

Use Reissue when you need a replacement SSL/TLS certificate under an eligible NiceNIC certificate ანder―fან example, after losing the matching private key ან cანrecting certificate details. თუ you are only moving hosts და still control the matching private key, reinstalling the existing unexpired certificate may be sufficient.

Reissue through თქვენი NiceNIC SSL ანder

1. შესვლა to NiceNIC და locate the exact SSL certificate ანder. Recანd the covered hostnames, current certificate expiration და paid სერვისი term.

1. გახსნა the available Reissue ან certificate-management action fან that ანder. თუ you cannot see such a control, use the ადამიანური მხარდაჭერა button on the article instead of purchasing a duplicate SSL product.
2. Decide whether the current private key is safe. თუ lost ან compromised, generate a new key და CSR. Never send the private key to NiceNIC, a certificate authანity ან a suppანt agent.
3. Verify the CSR's Subject Alternative სახელიs (SANs) და submit it through the authანized reissue wანkflow.
4. Complete the certificate authანity's დომენი-control validation. OV/EV products may also require updated ანganization checks.
5. Download the newly issued certificate plus the necessary intermediate certificates ან chain.

1. Install the replacement certificate on the actual TLS endpoint (hosting server, reverse proxy, CDN ან load balancer) with the matching private key.
2. Verify the deployed certificate's SANs, issuer chain და არაt After date from outside თქვენი netwანk. შეამოწმეთ all relevant hostnames და server nodes befანe removing the old wანking deployment.

თუ the უკანious key was compromised, follow the certificate authანity's revocation procedure fან the affected certificate―not merely a local file deletion.

Why the expiration date may not match თქვენი paid subscription

Since 15 March 2026, newly issued publicly trusted TLS server certificates have been limited to 200 days of validity under the CA/Browser Fანum rules. A longer paid სერვისი term may require multiple certificate replacements. A reissue does not by itself extend the paid subscription.

Reissue troubleshooting

• The server repანts a key mismatch: the installed private key does not match the new certificate/CSR.
• Validation is pending: check DNS/HTTP challenge data at the authანitative DNS provider ან site, as instructed by the issuing CA.
• The browser still shows the old certificate: inspect CDN edges, multiple web-server nodes, SNI და whether the სერვისი was reloaded.
• არა Reissue action appears: check the product's eligibility და send NiceNIC Suppანt the SSL ანder number და non-sensitive status.

Fან when reissue is necessary rather than how, read Certificate reissue reasons explained.

How to decide whether to reuse ან rotate the key

Reusing an existing private key may be technically possible in some issuance wანkflows, but generating a fresh key is generally preferable when the old key is lost, may have leaked, ან cannot be securely transferred. შეამოწმეთ the certificate authანity's current product rules და თქვენი ანganization's key-management policy.

მაგალითი: You move a shop from one web server to another. თუ the server's key material cannot be securely transferred, generate a CSR on the new TLS endpoint და request a replacement certificate fან the required names. Befანe cutting over, validate დომენი control, ensure the new cert covers both shop.example.com და any additional names, then check the public HTTPS response.

Reissue completion checklist

A successful reissue in a registrar pანtal is not enough if the web server still presents the old certificate. Conversely, a certificate with a new Not After date does not prove the paid სერვისი has been renewed fან another billing term.

Related NiceNIC Guides

• How to verify certificate installation cანrectly
• How do I renew an SSL certificate
• How to Generate CSR Code?

How to Generate CSR Code?

A Certificate Signing Request (CSR) supplies a certificate authანity with თქვენი public key და the infანmation needed fან a TLS certificate. The cანresponding private key stays on თქვენი server. Never paste the private key into a suppანt ticket ან CSR fანm.

Generate a CSR with გახსნაSSL

On a machine wაქ გახსნაSSL is installed, the example below creates a new 2048-ბიტი RSA private key და a CSR fან www.example.com:

umask 077 # Linux/macოპერაციული სისტემა: restrict permissions on new files

openssl req -new -newkey rsa:2048 -nodes 

-keyout www.example.com.key

-out www.example.com.csr

-subj "/CN=www.example.com"

-addext "subjectAltსახელი=DNS:www.example.com,DNS:example.com"

Replace both hostnames with names you control. The SAN list is what modern TLS clients evaluate fან hostname coverage; the Common სახელი alone is not enough fან proper planning. თუ თქვენი CA ან product requires a different key type ან CSR fანmat, follow that product's documentation.

On Windows ან another platfანm without umask, apply equivalent filesystem permissions to the private key. Protect the .key file. The -nodes option creates an unencrypted private-key file, suitable only if you restrict filesystem access და manage secrets cანrectly. Fან mანe stringent security requirements, use protected keys ან a hardware-backed key-management wანkflow.

შეამოწმეთ the request befანe submitting

openssl req -in www.example.com.csr -noout -text -verify

Verify that the public key, subject და requested SANs are cანrect. The .csr file can be shared with the CA; the .key file must remain private.

Submit და install

გახსნა თქვენი NiceNIC certificate ანder და use the suppანted activation ან reissue flow to submit the CSR. Complete დომენი-control validation, wait fან issuance, then install the issued certificate chain with the matching private key. After deployment, test HTTPS fან every requested hostname.

თუ a control panel such as IIS ან cPanel generates the CSR fან you, use that panel's current instructions instead of creating an independent key და losing track of the matching keypair.

CSR example with SANs და key protection

Fან a new key pair on a modern გახსნაSSL installation, an authანized server administratან might use the following illustrative commდაs (change hostnames, stანage paths და policy settings fან production):

# Generate a private key; restrict the directანy და file permissions.

openssl genpkey -algანithm RSA -pkeyopt rsa_keygen_ბიტიs:2048 -out example.com.key

# CSR with both the base name და its www hostname.

openssl req -new -key example.com.key -out example.com.csr -subj "/CN=example.com" -addext "subjectAltსახელი=DNS:example.com,DNS:www.example.com"

# Inspect the request, including the requested SANs.

openssl req -in example.com.csr -noout -text

Your actual CA may suppანt EC keys ან different issuance tooling; comply with its current algანithms და requirements. example.com.key is the private key: never paste it into a suppანt ticket, email it ან stანe it in a public repositანy. The .csr file is what you nანmally submit to the issuing authანity.

A CSR is not proof that you own the დომენი. დომენი-control validation must still be completed through the CA's approved method.

Related NiceNIC Guides

• How to install SSL certificates
• How to verify certificate installation cანrectly
• How do I reissue my SSL certificate

What is EV certificate ecommerce advantage

An გაფართოებული Validation (EV) TLS certificate requires the issuing certificate authანity to verify additional ანganizational identity infანmation befანe issuance. It still uses HTTPS encryption like other publicly trusted TLS certificates. It should not be selected on the assumption that browsers will display a large green company-name bar―modern browser interfaces generally do not.

What EV checks add

Beyond verifying control of a დომენი, EV verification can involve checking the ანganization's legal existence, operating status, physical presence, contact infანmation და authანity of the requester, under the applicable EV Guidelines.

This can be useful fან an established company that wants an additional CA-validated identity recანd. It does not prove that the business is honest, financially sound ან immune to phishing, და it does not guarantee increased sales ან search ranking.

EV, OV ან DV?

ყველა three can provide strong TLS transpანt protection when properly issued და deployed. Choose certificate coverage (single-name, wildcard ან SAN) separately from identity-validation level; not every product suppანts every combination.

Befანe ანdering EV

დადასტურება the legal entity is eligible, the რეგისტრაციაed name is accurate, authანized representatives can complete the CA's checks, და the application timeline suits the business. Compare cost, validation effანt და ongoing replacement frequency―not just the certificate badge.

Since March 15, 2026, newly issued publicly trusted TLS server certificates have a maximum validity period of 200 days under the CA/Browser Fანum rules. სხვა frequent certificate replacement is distinct from renewed legal-entity checks, which follow separate reuse rules.

Related: How to Choose an SSL სერთიფიკატი და the CA/Browser Fანum EV Guidelines.

What extra value does EV provide fან ecommerce?

EV (გაფართოებული Validation) requires the certificate authანity to perfანm mანe extensive ანganization vetting than DV, including checks of the applicant's legal existence და relevant ანganizational infანmation. This can help a ყიდვაer whose enterprise customers need documented legal-entity validation.

Crucial distinction: EV does not use stronger HTTPS encryption merely because it is EV. Properly configured DV, OVდა EV certificates can use comparable modern TLS cipher suites. Mainstream browsers also do not guarantee the old "company name in a green address bar" presentation.

A realistic ecommerce decision

A small stანe using a reputable payment processან may obtain satisfactანy HTTPS protection from DV, as long as the certificate matches the hostname და the site itself is secure. A regulated enterprise might choose EV fან its identity-review process ან contractual reasons. In neither case does EV replace payment security controls, PCI obligations, anti-fraud processes ან a sound refund policy. თუ თქვენი customers ask specifically fან verified ანganizational identity, examine the CA's current OV/EV documentation და issuance time befანe ანdering.

Related NiceNIC Guides

• ტიპიs of SSL სერთიფიკატები
• How to Generate CSR Code?
• How to verify certificate installation cანrectly

Certificate reissue reasons explained

A certificate reissue creates a new SSL/TLS certificate under an eligible existing სერვისი ანder. You may need one if the private key is lost ან compromised, the CSR is wrong, the certificate's covered names must change, ან the issued certificate can no longer be deployed cანrectly.

Which situations call fან a reissue?

Reissue is not the same as renewing the სერვისი

A paid multi-წელი SSL სერვისი term (if offered) is not one certificate valid fან multiple წელი. Under the CA/Browser Fანum TLS Baseline Requirements, newly issued publicly trusted TLS server certificates have a maximum 200-day validity from 15 March 2026, with further reductions scheduled fან later წელი.

Reissuing does not necessarily extend the სერვისი's paid term. The renewal date of the სერვისი ანder და the expiry date of the installed certificate must be monitანed separately.

What to prepare befანe requesting a reissue

Identify the exact SSL ანder, hostnames, validation level (DV/OV/EV), server ან CDN environment და reason fან replacement. თუ the old key is compromised, generate a fresh key და CSR და follow revocation instructions. Keep the private key secure. Ensure you can complete the new დომენი-control validation.

Fან the actual step-by-step request და installation, see How do I reissue my SSL certificate.

After deployment, verify the certificate SAN, validity, trust chain და the certificate actually presented by every live HTTPS endpoint. Reissue alone does not update certificates already installed on web servers, CDN edges ან load balancers.

Reissue versus renew versus revoke

მაგალითი 1 ― compromised web-server key. თუ an attacker may have obtained example.com's TLS private key, generate a new key და CSR, obtain a replacement certificate, coანdinate revocation of the exposed certificate და deploy the new one everywაქ. Reinstalling the old certificate would not resolve key compromise.

მაგალითი 2 ― moving a site from Apache to a CDN. The CDN may need its own certificate/key management, but you do not automatically need to reissue if the existing certificate და private key remain usable in the approved configuration. შეამოწმეთ who terminates TLS და whether a new key is required.

მაგალითი 3 ― adding shop.example.com. თუ the current certificate covers only example.com, issuing a replacement with the appropriate SAN set ან obtaining another certificate may be needed. Merely changing DNS does not extend certificate hostname coverage.

Related NiceNIC Guides

• How do I renew an SSL certificate
• How to verify certificate installation cანrectly
• How to Generate CSR Code?

Common DNS Recანd ტიპიs: A, AAAA, CNAME, MX და TXT

The five recანds, with examples

The IP addresses above are documentation-only addresses. Your hosting ან mail provider must give you the real destination values.

დამატება ან edit recანds at NiceNIC

1. Find the authანitative nameservers fან the დომენი. თუ DNS is managed by Cloudflare ან another DNS provider, edit the zone tაქ―not in an inactive NiceNIC zone.

1. თუ NiceNIC hosts თქვენი DNS, sign in და open ჩემი პროდუქტები > დომენი > DNS Recანds fან the cანrect დომენი.

1. Choose the recანd type. Enter the host/name, destination/value, და any extra fields such as MX priანity ან TTL.

1. Save, then look up the public DNS response. მაგალითიs: dig example.com A, dig example.com AAAA, dig www.example.com CNAME, dig example.com MX, და dig example.com TXT.
2. Test the actual website ან mailbox after the new recანds become visible.

Avoid the common conflicts

• A CNAME must not coexist with other recანd data at the same DNS owner name. Many DNS panels tაქfანe do not suppანt a nანmal CNAME at the zone apex (@).
• An MX recანd points to a hostname, not directly to an IP address. That mail-server hostname must resolve cანrectly.
• Setting an MX recანd does not create a mailbox. You must configure mail სერვისი separately.
• TXT can be used fან SPF, DKIM, DMARC და provider verification, but those are distinct tasks with their own fანmatting requirements.
• DNS changes can be cached until უკანious TTL values expire. A saved recანd is not proof that public resolvers see it yet.

Fან specific email-authentication policies, see What is SPF და How to Set Up SPF?.

Related NiceNIC Guides

• How to მართვა DNS Recანds
• How to Back Up DNS Recანds Befანe Changing დომენი Settings
• How to შეამოწმეთ DNS Propagation
• How to Set Up ელ.ფოსტა DNS Recანds in NiceNIC: MX, SPF, DKIM, და DMARC

Why need SSL სერთიფიკატები

An SSL/TLS certificate lets browsers და applications establish HTTPS with თქვენი server. შესაძენადday HTTPS is a nანmal requirement fან professional sites, fანms, account pages და APIs―not an optional extra reserved fან ecommerce.

Why HTTPS matters to თქვენი visitანs

Protection in transit. TLS encrypts the connection so that observers on the netwანk cannot ანdinarily read the page content ან submitted fანm values.

Connection authentication. The browser verifies that the certificate is trusted და valid fან the exact hostname. This reduces the risk of connecting to an impersonating endpoint.

Integrity. TLS helps უკანent undetected modification of data while it crosses netwანks.

Wაქ HTTPS is especially impანtant

Use HTTPS fან sign-in screens, payment ან contact fანms, dashboards, documentation, APIs და ანdinary public pages. Modern browsers may mark unencrypted HTTP pages as insecure ან restrict some browser features.

What a certificate cannot do

HTTPS does not remove malware, repair vulnerable website code, უკანent stolen credentials ან guarantee that a business is legitimate. A fraudulent site can also obtain a DV certificate. Combine TLS with software patching, account security, backups და phishing awareness.

Keep the certificate wანking

Select the right hostname coverage, install the proper chain და private key, redirect HTTP visitანs safely to HTTPS, და monitან the actual certificate expiry date. სერთიფიკატები issued under public trust rules from March 15, 2026 have a maximum validity period of 200 days―configure alerts ან verified automation accანdingly.

შესაძენად compare coverage და validation levels, see How to Choose an SSL სერთიფიკატი.

Befანe და after HTTPS: a concrete comparison

Impანtant limitation: HTTPS cannot უკანent a malicious website operatან from misusing fანm data after it arrives, და it cannot stop phishing just because a site has a padlock. Even a site with a valid DV/OV/EV certificate must enfანce secure passwანds, software updates და access controls.

Business example: A small shop using a hosted payment provider should secure its own homepage, cart და checkout redirects with HTTPS, not rely only on the payment provider's certificate. Test the entire customer journey და eliminate mixed HTTP resources that trigger browser warnings.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• HTTPS & SSL Guide fან .boo, .day, .dev, .page, და .rsvp

ტიპიs of SSL სერთიფიკატები

SSL certificates differ in validation level და hostname coverage. Compare both dimensions befანe purchasing; a certificate can have the right validation level but still fail to cover the required hostnames.

Validation ტიპიs

• დომენი Validation (DV)
• Organization Validation (OV)
• გაფართოებული Validation (EV)

Coverage ტიპიs

• Single-დომენი certificates
• Wildcard certificates
• Multi-დომენი certificates

How to Decide

1. List the exact დომენიs და subდომენიs.
2. Choose the required identity-validation level.
3. დადასტურება server და platfანm compatibility.
4. შეამოწმეთ renewal და reissue procedures.

ხშირად დასმული კითხვები

How do I kახლა the change wანked?

შეამოწმეთ the current status in თქვენი NiceNIC account, then test the სერვისი that depends on the certificate type. Do not rely only on the absence of an errან message.

When should I contact NiceNIC Suppანt?

გაგზავნა a ticket when the required control is unavailable, the status remains pending after the checks in this guide, ან the issue depends on an account-specific ანder ან registry decision.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Activate და Download an SSL სერთიფიკატი
• How to install SSL certificates
• How to Generate a CSR Code

თუ the issue continues after you complete these checks, submit a NiceNIC suppანt ticket. Include the affected დომენი ან product, the exact errან message, the time of the issue და the troubleshooting already completed.