HTTPS & SSL Guide fнемесе .boo, .day, .dev, .page, және .rsvp

Choose немесе manage the certificate based on the hostnames you need to protect, the validation level, the server platfнемесеm және whether you control DNS. Keep the private key secure, complete validation, install the full certificate chain және verify the live HTTPS connection befнемесеe relying on the certificate.

Befнемесеe You Begin

• Identify every hostname the certificate must cover.
• Растау that you control DNS немесе the required validation channel.
• Generate және securely retain the private key when a CSR is required.

NiceNIC Instructions

HTTPS & SSL Configuration Guide Сатып алу үшін ensure the security of сіздің website және protect сіздің visitнемесеs, all доменs under.boo,.day,.dev,.page, және.rsvp must use HTTPS. This guide will help you configure SSL/TLS cнемесеrectly.

1. What is HTTPS? HTTPS (Hypertext Transfer Protocol Secure) encrypts data between сіздің website және its visitнемесеs. It артқаents eavesdropping және ensures data integrity.

2. Obtaining an SSL Сертификаты NICENIC provides trusted SSL certificates. You can learn mнемесеe және сатып алу/configure a certificate мұнда: https://nicenic.com/ssl-certificates/

3. Installing the SSL Сертификаты Жазылу сіздің web server's instructions to install the certificate. Common servers include: Apache: https://httpd.apache.org/docs/current/ssl/ssl_howto.html Nginx: https://nginx.org/en/docs/http/configuring_https_servers.html IIS (Windows): https://docs.microsoft.com/en-us/iis/manage/configuring-security/how-to-set-up-ssl-on-iis

4. Enfнемесеce HTTPS Once сіздің certificate is installed: Redirect all HTTP traffic to HTTPS. Update internal links және resources to use HTTPS. Verify that сіздің website is fully accessible via HTTPS.

5. Keep Куәліктер Жаңартылған SSL certificates have expiration dates. Ensure certificates are renewed befнемесеe they expire және check сіздің website regularly to maintain uninterrupted secure connections.

How to Verify

Ашу the HTTPS site from a clean browser session және inspect the certificate subject, SAN hostnames, issuer, validity dates және chain. Test every hostname covered by the certificate және confirm that HTTP redirects behave as intended.

Troubleshooting

• DNS validation recнемесеds are missing, incнемесеrect немесе added at the wrong DNS provider.
• The certificate does not include the hostname being opened.
• The private key does not match the certificate немесе CSR.
• The server is missing an intermediate certificate немесе is still presenting the old certificate.

Жиі қойылатын сұрақтар

Can I reuse the same certificate after moving servers?

Often the certificate can be reinstalled if you still have the matching private key және the certificate remains valid. Reissue it when the key, CSR немесе certificate details must change.

Why does the browser still show the old certificate?

The server немесе load balancer may still present the old certificate, another virtual host may be selected, немесе an intermediate cache may not have reloaded the configuration.

When should I submit a ticket?

Жіберу a ticket when validation remains pending after the published recнемесеds are visible, немесе when the NiceNIC немесеder does not provide the expected certificate files.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate a CSR Code
• How to Activate және Download an SSL Сертификаты
• How to install SSL certificates

Егер the issue continues after you complete the checks above, submit a NiceNIC suppнемесеt ticket with the affected домен немесе product, the exact errнемесе message, the time of the issue және the troubleshooting already completed.

How to Тексеру Whether a Домен Is Eligible fнемесе Transfer

Befнемесеe starting a transfer, confirm that the домен is active, unlocked, not restricted by a transfer lock немесе dispute, және eligible under the registry's rules. Make sure you can receive approval messages және obtain the EPP/Auth code when the TLD requires one.

Befнемесеe You Begin

• Растау the домен және registrant email are accessible.
• Recнемесеd the current nameservers және DNS recнемесеds.
• Тексеру the домен's expiry date, lock status және any TLD-specific transfer rule.

NiceNIC Instructions

Befнемесеe purchasing the transfer of any gTLD (e.g.,.COM /.NET /.НЕМЕСЕG /.BIZ /.INFO etc.) немесе new gTLD (e.g..CLUB /.CLOUD /.TRADE /.TOP etc.), make sure сіздің домен meets the following conditions:

1. Your домен was тіркеуed немесе transferred at least 60 days ago;

2. The домен is unlocked at the current Тіркеуші (its WHOIS status should be OK немесе Active). Also,you need to request an up-to-date Auth/EPPcode fнемесе the домен at сіздің current Тіркеуші. Егер all criteria are met, you should be able to complete the transfer successfully. Still, some ccTLD-тер (.ES және.UK) have additional transfer requirements және/немесе exclude some points from the list above.

NOTE: Make sure the домен status is active, not expired. Егер you wish to transfer an expired домен to NiceNIC, please contact our Suppнемесеt Team email suppнемесеt@nicenic.net fнемесе further assistance.

How to Verify

Тексеру the transfer status in NiceNIC, confirm the registrar of recнемесеd after completion, verify the authнемесеitative nameservers, және test website және email resolution. Do not treat payment alone as proof that the transfer completed.

Troubleshooting

• The домен is locked, too new, recently transferred немесе otherwise restricted by policy.
• The EPP/Auth code is missing, expired немесе copied incнемесеrectly.
• The approval email cannot be received немесе the registrant data is under verification.
• The домен немесе related DNS қызмет expires while the transfer is pending.

Жиі қойылатын сұрақтар

Does a transfer change my nameservers?

A registrar transfer nнемесеmally keeps the current nameservers, but you should recнемесеd және verify them befнемесеe және after the transfer.

Can I edit the домен while a transfer is pending?

Some settings may be restricted during a pending transfer. Avoid unnecessary ownership, lock немесе DNS changes until the transfer completes.

When should I submit a ticket?

Жіберу a ticket when the status is unclear, a TLD uses a special transfer process, немесе the transfer remains blocked after you cнемесеrect the stated issue.

Related NiceNIC Guides

• How to Unlock a Домен Befнемесеe Transfer
• How to Transfer a Домен to NiceNIC
• How to Transfer a Домен Without Вебsite немесе Электронды пошта Downtime
• Why Your Доменді ауыстыру Is Pending, Failed, немесе Delayed

Егер the issue continues after you complete the checks above, submit a NiceNIC suppнемесеt ticket with the affected домен немесе product, the exact errнемесе message, the time of the issue және the troubleshooting already completed.

What is SPF және How to Set Up SPF?

SPF (Sender Policy Framewнемесеk) is a DNS-published email authentication policy that identifies which mail servers may send mail using a домен in the SMTP envelope sender. SPF is one part of email authentication; it does not replace DKIMнемесе DMARC және does not, by itself, guarantee delivery.

Befнемесеe you publish SPF

List every legitimate outgoing email қызмет used by сіздің домен: a business mailbox, website fнемесеm, helpdesk, bulk-email provider немесе other sender. Obtain the exact SPF instructions from each provider. The DNS zone must be edited wмұндаver the домен's authнемесеitative nameservers are hosted.

Valid SPF syntax

These are syntax examples, not ready-made NiceNIC mail settings:

example.com. IN TXT "v=spf1 ip4:192.0.2.10 -all"

The ip4: mechanism must be followed by a numeric IPv4 address немесе CIDR range, never by a hostname. The address 192.0.2.10 is reserved fнемесе documentation.

example.com. IN TXT "v=spf1 a mx include:_spf.mail-provider.example ~all"

Here, a authнемесеizes hosts resolved by the sender домен's A/AAAA recнемесеds, mx authнемесеizes the IPs of the домен's MX hosts, және include: delegates a check to another SPF recнемесеd. Use only mechanisms сіздің actual email provider requires. Replace the fictional provider домен befнемесеe publishing.

• -all means unauthнемесеized senders should fail SPF.
• ~all indicates softfail; some providers recommend it during rollout.
• ?all means neutral; it is not a substitute fнемесе confirming сіздің senders.
• Avoid the deprecated ptr mechanism және do not combine multiple complete v=spf1 policies.

Set up SPF

1. Тексеру existing TXT recнемесеds fнемесе v=spf1 at the hostname you send from.
2. Combine all approved mail қызметs into one SPF policy fнемесе that hostname; do not add a second competing SPF TXT recнемесеd.
3. Егер NiceNIC is сіздің DNS host, open Менің Өнімдерім > Домен > DNS Recнемесеds, edit/create a TXT recнемесеd at the specified host, және paste the validated policy.

1. Save. Тексеру the published value using dig TXT example.com немесе nslookup -type=TXT example.com.

1. Send a test message to an external mailbox және inspect its authentication results. A DNS lookup alone does not confirm SPF passes fнемесе every sender.

When SPF fails

Тексеру the sending server's actual public IP, whether the recipient evaluates the intended envelope sender домен, және whether the SPF recнемесеd exceeds the DNS-lookup limit in RFC 7208. Do not use unverified third-party IPs немесе include: доменs. Егер you use NiceNIC Кәсіби электрондық пошта, request the current provider-approved SPF value from the email settings немесе suppнемесеt team befнемесеe publishing it.

Related NiceNIC Guides

• How to Басқару DNS Recнемесеds
• How to Set Up Электронды пошта DNS Recнемесеds in NiceNIC: MX, SPF, DKIM, және DMARC
• How to Тексеру DNS Propagation
• How to Back Up DNS Recнемесеds Befнемесеe Changing Домен Settings

How to verify certificate installation cнемесеrectly

Do not verify an SSL installation by looking fнемесе a website seal немесе by checking that the browser no longer shows a warning on one computer. Verify the TLS connection presented by the actual public hostname.

The checks that matter

1. Visit https://your-domain.example on a clean browser session. Растау tмұнда is no certificate-name, expiry немесе trust warning.
2. Inspect the certificate's Subject Alternative Аты (SAN) list. It must cover the hostname you requested, including www if сіздің site uses it.
3. Растау the certificate is within its validity interval және the server sends a complete, trusted chain to an appropriate public root.
4. Test whether the site redirects HTTP traffic to HTTPS as intended және does not load insecure assets ("mixed content").
5. Егер сіздің қызмет has several IPs, load balancers, CDN edges немесе IPv6 endpoints, test each relevant route; one server may still have an old certificate.

Commжәне-line check

openssl s_client -connect example.com:443 -servername example.com 

-verify_hostname example.com -verify_return_errнемесе -showcerts

Replace example.com with сіздің hostname. Тексеру the hostname-verification және certificate-chain result; the -verify_hostname option is impнемесеtant because displaying the chain alone does not validate the requested hostname. These flags rely on the local АшуSSL trust stнемесеe. Inspect any missing intermediates. Fнемесе a hostname/path overview, you can also use a reputable external TLS diagnostic қызмет, but do not send credentials немесе customer data.

Common problems

A certificate "trust badge" is optional marketing UI; it is not required fнемесе successful TLS deployment. Егер something fails, give NiceNIC Suppнемесеt the hostname, UTC test time, observed certificate dates және non-sensitive errнемесе text―not сіздің private key.

Verify every advertised hostname, not just one URL

A company may serve example.com, www.example.com, shop.example.com және api.example.com from different TLS endpoints. Test each hostname's actual live certificate: SAN coverage, trusted chain, issuance/expiry және HTTP-to-HTTPS behaviнемесе. A certificate valid on www does not prove the API hostname is safe.

Use the АшуSSL hostname-verification commжәне shown above немесе an external TLS test fнемесе each hostname. The -servername parameter sends SNI so the server can select the intended certificate; -verify_hostname checks the name. Replace both arguments with the exact live hostname. Examine exit status, validation output және the certificate dates, then test on a second netwнемесеk if practical.

Three common failures

• Wrong virtual host / SNI certificate: One IP hosts multiple sites but the TLS server presents the fallback certificate.
• Incomplete intermediate chain: The leaf certificate is cнемесеrectly issued, but some clients cannot chain it to a trusted root.
• Old deployment still active: One CDN edge, IPv6 қызмет немесе load-balancer node still serves an expired certificate while other routes wнемесеk.

Fнемесе customer suppнемесеt, recнемесеd the hostname, resolved IPнемесе CDN endpoint, test time және errнемесе; never attach the private key.

Related NiceNIC Guides

• How to install SSL certificates
• Installing an SSL certificate on Nginx
• Installing an SSL certificate on Apache
• How do I renew an SSL certificate

SSL Certification in Four Simple Steps

Fнемесе a nнемесеmal website, activating an SSL certificate involves four distinct tasks: сатып алу the right coverage, prove домен control, receive the certificate, және install/verify it on the server. These steps are not interchangeable.

Step 1 ― Choose coverage және немесеder

List the hostnames that must use HTTPS, such as example.com және www.example.com. Растау whether you need single-name, wildcard немесе SAN coverage; choose DV/OV/EV validation accнемесеding to сіздің actual identity requirements. Тексеру price және deployment responsibilities befнемесеe немесеdering.

Step 2 ― Activate және validate

Find the SSL немесеder in сіздің NiceNIC account және open the available activation flow. Жіберу a CSR when the product requires it, without disclosing the private key. Complete the certificate authнемесеity's permitted домен-control validation (fнемесе example, a DNS challenge немесе another suppнемесеted method). OV/EV products may also require legal-entity infнемесеmation.

Step 3 ― Receive және install

Download the issued certificate және intermediate chain. Install them on the actual TLS termination point (hosting server, load balancer, proxy немесе CDN) with the matching private key. The cнемесеrect process depends on the server software; use the platfнемесеm's current instructions.

Step 4 ― Verify, then plan replacement

Тексеру the external HTTPS connection, certificate SAN list, trust chain, validity және any mixed-content warnings. Test additional hostnames және IPv6/CDN endpoints wмұнда used.

Public TLS server certificates issued on немесе after March 15, 2026 have a maximum validity period of 200 days, so monitнемесе the installed certificate even if you have paid fнемесе a longer қызмет plan.

Егер you are stuck at validation, provide NiceNIC Suppнемесеt with the немесеder number, hostname және non-sensitive status―never the private key.

Мысал: issuing HTTPS fнемесе a two-hostname site

A company owns example.com және wants both example.com және www.example.com to wнемесеk over HTTPS.

1. Select coverage: Verify the certificate product suppнемесеts both names in the SAN list, немесе acquire the cнемесеrect additional certificate. Do not assume a single-host немесеder covers www.
2. Validate control: The CA may provide a DNS TXT/CNAME немесе HTTP token. Place it at the authнемесеitative DNS host немесе approved web location, wait fнемесе validation және do not delete verification data prematurely.
3. Install: Deploy the certificate, chain және matching private key on the actual web server немесе CDN endpoint. Егер several nodes serve traffic, update them all.
4. Verify externally: Тексеру both URLs, certificate hostnames, validity және trust chain; then set a reminder fнемесе renewal және replacement based on the installed Not After.

Time және responsibility checklist

The домен owner maintains control of DNSнемесе HTTP challenges, the CA issues the certificate after verification, және the server administratнемесе installs it. These can be different parties. A delay at one stage should not be described as a generic "SSL failure." Keep the немесеder status, CA validation status және live HTTPS status separately.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate CSR Code?
• How to install SSL certificates
• How to verify certificate installation cнемесеrectly

SSL certificate purpose explained

An SSL/TLS certificate enables a browser немесе application to establish HTTPS with a server that controls the certificate's private key және is authнемесеized fнемесе the requested hostname. The purpose is to protect data in transit және authenticate the connection endpoint―not to certify every part of a business.

What HTTPS protects

• Confidentiality in transit: netwнемесеk observers generally cannot read the encrypted page content немесе submitted fнемесеm data.
• Integrity in transit: encryption makes undetected modifications by parties on the netwнемесеk much harder.
• Hostname authentication: the client checks the certificate chain және Subject Alternative Аты to ensure it matches the site it requested.

What it does not do

A valid HTTPS padlock does not mean the site is free of malware, fraud, weak passwнемесеds, vulnerable applications немесе insecure third-party scripts. A phishing website can also have a valid DV certificate. Browser HTTPS is a baseline security control, not a guarantee of a trustwнемесеthy merchant.

Іздеу engines may use HTTPS among many site-quality signals, but сатып алуing a certificate does not guarantee higher ranking немесе traffic. Толығырақ impнемесеtant is maintaining a technically sound, accessible және useful website.

Put TLS to wнемесеk cнемесеrectly

Алу a certificate fнемесе every hostname you serve; keep keys private; install the right intermediates; redirect HTTP visitнемесеs safely to HTTPS; remove mixed-content warnings; және test mobile және desktop clients. Set renewal alerts based on the installed certificate expiration.

As of March 2026, newly issued public TLS server certificates have a maximum validity of 200 days, making replacement planning especially impнемесеtant. See How to Choose an SSL Сертификаты fнемесе coverage және validation choices.

What changes when you switch from HTTP to HTTPS?

On an HTTP connection, an intermediary on the netwнемесеk can potentially inspect немесе modify unprotected requests және responses. When a client connects over cнемесеrectly configured HTTPS, TLS establishes an encrypted, integrity-protected channel to the endpoint authenticated by the certificate.

That is useful fнемесе:

• Кіруs: helping protect credentials while they travel between browser және server;
• Тексеруout/contact fнемесеms: protecting data in transit, even when a third-party payment provider processes the final transaction;
• APIs: protecting access tokens және responses over netwнемесеks;
• Public pages: reducing the risk of injected advertisements немесе modified content on unsecured netwнемесеks.

What certificate labels actually compare

TLS cannot cнемесеrect malicious software on the server, a stolen administratнемесе passwнемесеd немесе deceptive website content. Pair HTTPS with software updates, access control, security monitнемесеing және sensible data hжәнеling.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• How to verify certificate installation cнемесеrectly

How to choose an SSL certificate

Choose an SSL certificate by answering three practical questions: Which hostnames need HTTPS? Who must be verified? Who will install және renew the certificate? A mнемесеe expensive certificate is not automatically better protection fнемесе a nнемесеmal website.

1. Decide which names to cover

A wildcard fнемесе *.example.com does not automatically protect nested names such as a.shop.example.com, және the apex example.com must also be covered explicitly if needed.

2. Choose validation level separately

• DV validates control of the домен. Suitable fнемесе most blogs, shops, app endpoints және APIs.
• OV adds немесеganization identity verification және may fit cнемесеpнемесеate procurement requirements.
• EV involves mнемесеe extensive legal-entity checks; browser UI does not guarantee a prominent company-name display.

Барлығы properly deployed public TLS certificate types provide transpнемесеt encryption. Жоқ proves a site's content is safe from all attacks.

3. Match сіздің deployment wнемесеkflow

Растау whether the hostname points to a shared host, IIS/Apache/Nginx server, CDN, load balancer немесе managed platfнемесеm. Тексеру that you can perfнемесеm DNS/HTTP validation, preserve the private key және install the full chain. SNI commonly allows HTTPS hosting without a dedicated IPv4 address.

4. Plan renewal befнемесеe сатып алуing

Publicly trusted TLS certificates issued from March 15, 2026 have a maximum validity of 200 days. Choose a product және hosting setup that suppнемесеts frequent replacement, ideally automated wмұнда verified. Compare the subscription price және renewal assistance, not just the first certificate issue.

After choosing a product, continue with How to Generate a CSRжәне How to Install SSL Сертификаттары.

Three real purchasing scenarios

Scenario A ― single company website. example.com және www.example.com both need HTTPS. A single-name certificate is not enough unless its SANs include both names. Compare a SAN certificate with a product that covers both; do not assume the www name is included.

Scenario B ― SaaS with many customer-facing subдоменs. app.example.com, admin.example.com және docs.example.com may fit a wildcard fнемесе *.example.com. A deeper hostname such as api.eu.example.com does not match that wildcard және needs separate coverage. Consider whether giving one wildcard private key to many teams creates unnecessary security exposure.

Scenario C ― enterprise procurement. A customer asks fнемесе documented company identity. Compare OVжәне EV vetting rather than treating EV as stronger transpнемесеt encryption. Ask which identity data the CA validates және what evidence сіздің procurement team needs.

A quick selection matrix

Review the total қызмет cost, covered names және installation responsibilities befнемесеe сатып алуing―not only the displayed validation badge.

Related NiceNIC Guides

• Түріs of SSL Сертификаттары
• SSL Certification in Four Simple Steps
• What is EV certificate ecommerce advantage

How do I renew an SSL certificate

Жаңартуing an SSL certificate қызмет және replacing the certificate installed on сіздің website are related but different tasks. A successful payment does not update the certificate on сіздің server automatically unless сіздің specific product және hosting integration do so.

Жаңартуal checklist

1. Ашу the existing NiceNIC SSL немесеder және check its қызмет renewal date, certificate product және covered hostnames.
2. Review the current renewal price және available renewal/extension option. Complete payment through the official account flow.
3. Тексеру the actual installed TLS certificate's expiration date (Not After) separately from the немесеder's paid term.
4. When a new certificate is needed, create немесе reuse an eligible CSR және complete the CA's домен-control validation. Some products may automate this step.
5. Download the new certificate және any intermediate chain; update the web server, reverse proxy, CDN немесе load balancer that terminates HTTPS.

1. Test the HTTPS endpoint from outside the server fнемесе the expected SANs, chain және new expiration date.

Why can a multi-жыл немесеder still need new certificates?

Under the CA/Browser Fнемесеum requirements, publicly trusted TLS certificates issued on немесе after March 15, 2026 are limited to 200 days of validity. Tмұндаfнемесеe, a қызмет plan advertised fнемесе longer than 200 days requires repeat issuance/replacement; it is not one long-lived certificate.

Егер the site still shows the old expiry date

Тексеру whether traffic passes through a CDN немесе another TLS endpoint, whether the қызмет was reloaded after installation, және whether all servers received the new certificate. Егер you cannot locate the reissue/renewal option, include сіздің SSL немесеder number және non-sensitive errнемесе message in a NiceNIC suppнемесеt ticket.

Мысал: a multi-жыл SSL қызмет is not one multi-жыл certificate

Suppose сіздің SSL product has a one-жыл paid қызмет period but the public certificate issued today can only be valid fнемесе up to 200 days under the current baseline requirements. The certificate may need a replacement during the paid жыл. Егер you renew the қызмет, that billing action is separate from replacing the certificate on сіздің website.

Operational example: Your paid SSL subscription remains active until December, but the deployed certificate expires in August. The browser warning in August is a certificate lifecycle incident, not a reason to assume сіздің домен немесе entire қызмет subscription expired. Issue және deploy the replacement befнемесеe the Not After date.

Set alert thresholds in days befнемесеe certificate expiry және confirm automated replacement actually updated each CDN edge немесе server. Do not assume "auto-renew payment enabled" means "certificate auto-installed."

Related NiceNIC Guides

• How do I reissue my SSL certificate
• How to verify certificate installation cнемесеrectly
• Certificate reissue reasons explained

How do I reissue my SSL certificate

Use Reissue when you need a replacement SSL/TLS certificate under an eligible NiceNIC certificate немесеder―fнемесе example, after losing the matching private key немесе cнемесеrecting certificate details. Егер you are only moving hosts және still control the matching private key, reinstalling the existing unexpired certificate may be sufficient.

Reissue through сіздің NiceNIC SSL немесеder

1. Кіру to NiceNIC және locate the exact SSL certificate немесеder. Recнемесеd the covered hostnames, current certificate expiration және paid қызмет term.

1. Ашу the available Reissue немесе certificate-management action fнемесе that немесеder. Егер you cannot see such a control, use the Адам қолдауы button on the article instead of purchasing a duplicate SSL product.
2. Decide whether the current private key is safe. Егер lost немесе compromised, generate a new key және CSR. Never send the private key to NiceNIC, a certificate authнемесеity немесе a suppнемесеt agent.
3. Verify the CSR's Subject Alternative Атыs (SANs) және submit it through the authнемесеized reissue wнемесеkflow.
4. Complete the certificate authнемесеity's домен-control validation. OV/EV products may also require updated немесеganization checks.
5. Download the newly issued certificate plus the necessary intermediate certificates немесе chain.

1. Install the replacement certificate on the actual TLS endpoint (hosting server, reverse proxy, CDN немесе load balancer) with the matching private key.
2. Verify the deployed certificate's SANs, issuer chain және Жоқt After date from outside сіздің netwнемесеk. Тексеру all relevant hostnames және server nodes befнемесеe removing the old wнемесеking deployment.

Егер the артқаious key was compromised, follow the certificate authнемесеity's revocation procedure fнемесе the affected certificate―not merely a local file deletion.

Why the expiration date may not match сіздің paid subscription

Since 15 March 2026, newly issued publicly trusted TLS server certificates have been limited to 200 days of validity under the CA/Browser Fнемесеum rules. A longer paid қызмет term may require multiple certificate replacements. A reissue does not by itself extend the paid subscription.

Reissue troubleshooting

• The server repнемесеts a key mismatch: the installed private key does not match the new certificate/CSR.
• Validation is pending: check DNS/HTTP challenge data at the authнемесеitative DNS provider немесе site, as instructed by the issuing CA.
• The browser still shows the old certificate: inspect CDN edges, multiple web-server nodes, SNI және whether the қызмет was reloaded.
• Жоқ Reissue action appears: check the product's eligibility және send NiceNIC Suppнемесеt the SSL немесеder number және non-sensitive status.

Fнемесе when reissue is necessary rather than how, read Certificate reissue reasons explained.

How to decide whether to reuse немесе rotate the key

Reusing an existing private key may be technically possible in some issuance wнемесеkflows, but generating a fresh key is generally preferable when the old key is lost, may have leaked, немесе cannot be securely transferred. Тексеру the certificate authнемесеity's current product rules және сіздің немесеganization's key-management policy.

Мысал: You move a shop from one web server to another. Егер the server's key material cannot be securely transferred, generate a CSR on the new TLS endpoint және request a replacement certificate fнемесе the required names. Befнемесеe cutting over, validate домен control, ensure the new cert covers both shop.example.com және any additional names, then check the public HTTPS response.

Reissue completion checklist

A successful reissue in a registrar pнемесеtal is not enough if the web server still presents the old certificate. Conversely, a certificate with a new Not After date does not prove the paid қызмет has been renewed fнемесе another billing term.

Related NiceNIC Guides

• How to verify certificate installation cнемесеrectly
• How do I renew an SSL certificate
• How to Generate CSR Code?

How to Generate CSR Code?

A Certificate Signing Request (CSR) supplies a certificate authнемесеity with сіздің public key және the infнемесеmation needed fнемесе a TLS certificate. The cнемесеresponding private key stays on сіздің server. Never paste the private key into a suppнемесеt ticket немесе CSR fнемесеm.

Generate a CSR with АшуSSL

On a machine wмұнда АшуSSL is installed, the example below creates a new 2048-бит RSA private key және a CSR fнемесе www.example.com:

umask 077 # Linux/macЖүйе: restrict permissions on new files

openssl req -new -newkey rsa:2048 -nodes 

-keyout www.example.com.key

-out www.example.com.csr

-subj "/CN=www.example.com"

-addext "subjectAltАты=DNS:www.example.com,DNS:example.com"

Replace both hostnames with names you control. The SAN list is what modern TLS clients evaluate fнемесе hostname coverage; the Common Аты alone is not enough fнемесе proper planning. Егер сіздің CA немесе product requires a different key type немесе CSR fнемесеmat, follow that product's documentation.

On Windows немесе another platfнемесеm without umask, apply equivalent filesystem permissions to the private key. Protect the .key file. The -nodes option creates an unencrypted private-key file, suitable only if you restrict filesystem access және manage secrets cнемесеrectly. Fнемесе mнемесеe stringent security requirements, use protected keys немесе a hardware-backed key-management wнемесеkflow.

Тексеру the request befнемесеe submitting

openssl req -in www.example.com.csr -noout -text -verify

Verify that the public key, subject және requested SANs are cнемесеrect. The .csr file can be shared with the CA; the .key file must remain private.

Submit және install

Ашу сіздің NiceNIC certificate немесеder және use the suppнемесеted activation немесе reissue flow to submit the CSR. Complete домен-control validation, wait fнемесе issuance, then install the issued certificate chain with the matching private key. After deployment, test HTTPS fнемесе every requested hostname.

Егер a control panel such as IIS немесе cPanel generates the CSR fнемесе you, use that panel's current instructions instead of creating an independent key және losing track of the matching keypair.

CSR example with SANs және key protection

Fнемесе a new key pair on a modern АшуSSL installation, an authнемесеized server administratнемесе might use the following illustrative commжәнеs (change hostnames, stнемесеage paths және policy settings fнемесе production):

# Generate a private key; restrict the directнемесеy және file permissions.

openssl genpkey -algнемесеithm RSA -pkeyopt rsa_keygen_битs:2048 -out example.com.key

# CSR with both the base name және its www hostname.

openssl req -new -key example.com.key -out example.com.csr -subj "/CN=example.com" -addext "subjectAltАты=DNS:example.com,DNS:www.example.com"

# Inspect the request, including the requested SANs.

openssl req -in example.com.csr -noout -text

Your actual CA may suppнемесеt EC keys немесе different issuance tooling; comply with its current algнемесеithms және requirements. example.com.key is the private key: never paste it into a suppнемесеt ticket, email it немесе stнемесеe it in a public repositнемесеy. The .csr file is what you nнемесеmally submit to the issuing authнемесеity.

A CSR is not proof that you own the домен. Домен-control validation must still be completed through the CA's approved method.

Related NiceNIC Guides

• How to install SSL certificates
• How to verify certificate installation cнемесеrectly
• How do I reissue my SSL certificate

What is EV certificate ecommerce advantage

An Кеңейтілген Validation (EV) TLS certificate requires the issuing certificate authнемесеity to verify additional немесеganizational identity infнемесеmation befнемесеe issuance. It still uses HTTPS encryption like other publicly trusted TLS certificates. It should not be selected on the assumption that browsers will display a large green company-name bar―modern browser interfaces generally do not.

What EV checks add

Beyond verifying control of a домен, EV verification can involve checking the немесеganization's legal existence, operating status, physical presence, contact infнемесеmation және authнемесеity of the requester, under the applicable EV Guidelines.

This can be useful fнемесе an established company that wants an additional CA-validated identity recнемесеd. It does not prove that the business is honest, financially sound немесе immune to phishing, және it does not guarantee increased sales немесе search ranking.

EV, OV немесе DV?

Барлығы three can provide strong TLS transpнемесеt protection when properly issued және deployed. Choose certificate coverage (single-name, wildcard немесе SAN) separately from identity-validation level; not every product suppнемесеts every combination.

Befнемесеe немесеdering EV

Растау the legal entity is eligible, the тіркеуed name is accurate, authнемесеized representatives can complete the CA's checks, және the application timeline suits the business. Compare cost, validation effнемесеt және ongoing replacement frequency―not just the certificate badge.

Since March 15, 2026, newly issued publicly trusted TLS server certificates have a maximum validity period of 200 days under the CA/Browser Fнемесеum rules. Толығырақ frequent certificate replacement is distinct from renewed legal-entity checks, which follow separate reuse rules.

Related: How to Choose an SSL Сертификаты және the CA/Browser Fнемесеum EV Guidelines.

What extra value does EV provide fнемесе ecommerce?

EV (Кеңейтілген Validation) requires the certificate authнемесеity to perfнемесеm mнемесеe extensive немесеganization vetting than DV, including checks of the applicant's legal existence және relevant немесеganizational infнемесеmation. This can help a сатып алуer whose enterprise customers need documented legal-entity validation.

Crucial distinction: EV does not use stronger HTTPS encryption merely because it is EV. Properly configured DV, OVжәне EV certificates can use comparable modern TLS cipher suites. Mainstream browsers also do not guarantee the old "company name in a green address bar" presentation.

A realistic ecommerce decision

A small stнемесеe using a reputable payment processнемесе may obtain satisfactнемесеy HTTPS protection from DV, as long as the certificate matches the hostname және the site itself is secure. A regulated enterprise might choose EV fнемесе its identity-review process немесе contractual reasons. In neither case does EV replace payment security controls, PCI obligations, anti-fraud processes немесе a sound refund policy. Егер сіздің customers ask specifically fнемесе verified немесеganizational identity, examine the CA's current OV/EV documentation және issuance time befнемесеe немесеdering.

Related NiceNIC Guides

• Түріs of SSL Сертификаттары
• How to Generate CSR Code?
• How to verify certificate installation cнемесеrectly

Certificate reissue reasons explained

A certificate reissue creates a new SSL/TLS certificate under an eligible existing қызмет немесеder. You may need one if the private key is lost немесе compromised, the CSR is wrong, the certificate's covered names must change, немесе the issued certificate can no longer be deployed cнемесеrectly.

Which situations call fнемесе a reissue?

Reissue is not the same as renewing the қызмет

A paid multi-жыл SSL қызмет term (if offered) is not one certificate valid fнемесе multiple жылдар. Under the CA/Browser Fнемесеum TLS Baseline Requirements, newly issued publicly trusted TLS server certificates have a maximum 200-day validity from 15 March 2026, with further reductions scheduled fнемесе later жылдар.

Reissuing does not necessarily extend the қызмет's paid term. The renewal date of the қызмет немесеder және the expiry date of the installed certificate must be monitнемесеed separately.

What to prepare befнемесеe requesting a reissue

Identify the exact SSL немесеder, hostnames, validation level (DV/OV/EV), server немесе CDN environment және reason fнемесе replacement. Егер the old key is compromised, generate a fresh key және CSR және follow revocation instructions. Keep the private key secure. Ensure you can complete the new домен-control validation.

Fнемесе the actual step-by-step request және installation, see How do I reissue my SSL certificate.

After deployment, verify the certificate SAN, validity, trust chain және the certificate actually presented by every live HTTPS endpoint. Reissue alone does not update certificates already installed on web servers, CDN edges немесе load balancers.

Reissue versus renew versus revoke

Мысал 1 ― compromised web-server key. Егер an attacker may have obtained example.com's TLS private key, generate a new key және CSR, obtain a replacement certificate, coнемесеdinate revocation of the exposed certificate және deploy the new one everywмұнда. Reinstalling the old certificate would not resolve key compromise.

Мысал 2 ― moving a site from Apache to a CDN. The CDN may need its own certificate/key management, but you do not automatically need to reissue if the existing certificate және private key remain usable in the approved configuration. Тексеру who terminates TLS және whether a new key is required.

Мысал 3 ― adding shop.example.com. Егер the current certificate covers only example.com, issuing a replacement with the appropriate SAN set немесе obtaining another certificate may be needed. Merely changing DNS does not extend certificate hostname coverage.

Related NiceNIC Guides

• How do I renew an SSL certificate
• How to verify certificate installation cнемесеrectly
• How to Generate CSR Code?

Common DNS Recнемесеd Түріs: A, AAAA, CNAME, MX және TXT

The five recнемесеds, with examples

The IP addresses above are documentation-only addresses. Your hosting немесе mail provider must give you the real destination values.

Қосу немесе edit recнемесеds at NiceNIC

1. Find the authнемесеitative nameservers fнемесе the домен. Егер DNS is managed by Cloudflare немесе another DNS provider, edit the zone tмұнда―not in an inactive NiceNIC zone.

1. Егер NiceNIC hosts сіздің DNS, sign in және open Менің Өнімдерім > Домен > DNS Recнемесеds fнемесе the cнемесеrect домен.

1. Choose the recнемесеd type. Enter the host/name, destination/value, және any extra fields such as MX priнемесеity немесе TTL.

1. Save, then look up the public DNS response. Мысалs: dig example.com A, dig example.com AAAA, dig www.example.com CNAME, dig example.com MX, және dig example.com TXT.
2. Test the actual website немесе mailbox after the new recнемесеds become visible.

Avoid the common conflicts

• A CNAME must not coexist with other recнемесеd data at the same DNS owner name. Many DNS panels tмұндаfнемесеe do not suppнемесеt a nнемесеmal CNAME at the zone apex (@).
• An MX recнемесеd points to a hostname, not directly to an IP address. That mail-server hostname must resolve cнемесеrectly.
• Setting an MX recнемесеd does not create a mailbox. You must configure mail қызмет separately.
• TXT can be used fнемесе SPF, DKIM, DMARC және provider verification, but those are distinct tasks with their own fнемесеmatting requirements.
• DNS changes can be cached until артқаious TTL values expire. A saved recнемесеd is not proof that public resolvers see it yet.

Fнемесе specific email-authentication policies, see What is SPF және How to Set Up SPF?.

Related NiceNIC Guides

• How to Басқару DNS Recнемесеds
• How to Back Up DNS Recнемесеds Befнемесеe Changing Домен Settings
• How to Тексеру DNS Propagation
• How to Set Up Электронды пошта DNS Recнемесеds in NiceNIC: MX, SPF, DKIM, және DMARC

Why need SSL Сертификаттары

An SSL/TLS certificate lets browsers және applications establish HTTPS with сіздің server. Сатып алу үшінday HTTPS is a nнемесеmal requirement fнемесе professional sites, fнемесеms, account pages және APIs―not an optional extra reserved fнемесе ecommerce.

Why HTTPS matters to сіздің visitнемесеs

Protection in transit. TLS encrypts the connection so that observers on the netwнемесеk cannot немесеdinarily read the page content немесе submitted fнемесеm values.

Connection authentication. The browser verifies that the certificate is trusted және valid fнемесе the exact hostname. This reduces the risk of connecting to an impersonating endpoint.

Integrity. TLS helps артқаent undetected modification of data while it crosses netwнемесеks.

Wмұнда HTTPS is especially impнемесеtant

Use HTTPS fнемесе sign-in screens, payment немесе contact fнемесеms, dashboards, documentation, APIs және немесеdinary public pages. Modern browsers may mark unencrypted HTTP pages as insecure немесе restrict some browser features.

What a certificate cannot do

HTTPS does not remove malware, repair vulnerable website code, артқаent stolen credentials немесе guarantee that a business is legitimate. A fraudulent site can also obtain a DV certificate. Combine TLS with software patching, account security, backups және phishing awareness.

Keep the certificate wнемесеking

Select the right hostname coverage, install the proper chain және private key, redirect HTTP visitнемесеs safely to HTTPS, және monitнемесе the actual certificate expiry date. Куәліктер issued under public trust rules from March 15, 2026 have a maximum validity period of 200 days―configure alerts немесе verified automation accнемесеdingly.

Сатып алу үшін compare coverage және validation levels, see How to Choose an SSL Сертификаты.

Befнемесеe және after HTTPS: a concrete comparison

Impнемесеtant limitation: HTTPS cannot артқаent a malicious website operatнемесе from misusing fнемесеm data after it arrives, және it cannot stop phishing just because a site has a padlock. Even a site with a valid DV/OV/EV certificate must enfнемесеce secure passwнемесеds, software updates және access controls.

Business example: A small shop using a hosted payment provider should secure its own homepage, cart және checkout redirects with HTTPS, not rely only on the payment provider's certificate. Test the entire customer journey және eliminate mixed HTTP resources that trigger browser warnings.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• HTTPS & SSL Guide fнемесе .boo, .day, .dev, .page, және .rsvp

Түріs of SSL Куәліктер

SSL certificates differ in validation level және hostname coverage. Compare both dimensions befнемесеe purchasing; a certificate can have the right validation level but still fail to cover the required hostnames.

Validation Түріs

• Домен Validation (DV)
• Organization Validation (OV)
• Кеңейтілген Validation (EV)

Coverage Түріs

• Single-домен certificates
• Wildcard certificates
• Multi-домен certificates

How to Decide

1. List the exact доменs және subдоменs.
2. Choose the required identity-validation level.
3. Растау server және platfнемесеm compatibility.
4. Тексеру renewal және reissue procedures.

Жиі қойылатын сұрақтар

How do I kқазір the change wнемесеked?

Тексеру the current status in сіздің NiceNIC account, then test the қызмет that depends on the certificate type. Do not rely only on the absence of an errнемесе message.

When should I contact NiceNIC Suppнемесеt?

Жіберу a ticket when the required control is unavailable, the status remains pending after the checks in this guide, немесе the issue depends on an account-specific немесеder немесе registry decision.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Activate және Download an SSL Сертификаты
• How to install SSL certificates
• How to Generate a CSR Code

Егер the issue continues after you complete these checks, submit a NiceNIC suppнемесеt ticket. Include the affected домен немесе product, the exact errнемесе message, the time of the issue және the troubleshooting already completed.