HTTPS & SSL Guide far .boo, .day, .dev, .page, ir .rsvp

Choose ar manage the certificate based on the hostnames you need to protect, the validation level, the server platfarm ir whether you control DNS. Keep the private key secure, complete validation, install the full certificate chain ir verify the live HTTPS connection befare relying on the certificate.

Befare You Begin

• Identify every hostname the certificate must cover.
• Patvirtinti that you control DNS ar the required validation channel.
• Generate ir securely retain the private key when a CSR is required.

NiceNIC Instructions

HTTPS & SSL Configuration Guide Į ensure the security of jūsų website ir protect jūsų visitars, all domenass under.boo,.day,.dev,.page, ir.rsvp must use HTTPS. This guide will help you configure SSL/TLS carrectly.

1. What is HTTPS? HTTPS (Hypertext Transfer Protocol Secure) encrypts data between jūsų website ir its visitars. It atgalents eavesdropping ir ensures data integrity.

2. Obtaining an SSL sertifikatas NICENIC provides trusted SSL certificates. You can learn mare ir įsigyti/configure a certificate čia: https://nicenic.com/ssl-certificates/

3. Installing the SSL sertifikatas Sekti jūsų web server's instructions to install the certificate. Common servers include: Apache: https://httpd.apache.org/docs/current/ssl/ssl_howto.html Nginx: https://nginx.org/en/docs/http/configuring_https_servers.html IIS (Windows): https://docs.microsoft.com/en-us/iis/manage/configuring-security/how-to-set-up-ssl-on-iis

4. Enfarce HTTPS Once jūsų certificate is installed: Redirect all HTTP traffic to HTTPS. Update internal links ir resources to use HTTPS. Verify that jūsų website is fully accessible via HTTPS.

5. Keep Sertifikatai Atnaujinta SSL certificates have expiration dates. Ensure certificates are renewed befare they expire ir check jūsų website regularly to maintain uninterrupted secure connections.

How to Verify

Atidaryti the HTTPS site from a clean browser session ir inspect the certificate subject, SAN hostnames, issuer, validity dates ir chain. Test every hostname covered by the certificate ir confirm that HTTP redirects behave as intended.

Troubleshooting

• DNS validation recards are missing, incarrect ar added at the wrong DNS provider.
• The certificate does not include the hostname being opened.
• The private key does not match the certificate ar CSR.
• The server is missing an intermediate certificate ar is still presenting the old certificate.

Dažniausiai užduodami klausimai

Can I reuse the same certificate after moving servers?

Often the certificate can be reinstalled if you still have the matching private key ir the certificate remains valid. Reissue it when the key, CSR ar certificate details must change.

Why does the browser still show the old certificate?

The server ar load balancer may still present the old certificate, another virtual host may be selected, ar an intermediate cache may not have reloaded the configuration.

When should I submit a ticket?

Pateikti a ticket when validation remains pending after the published recards are visible, ar when the NiceNIC arder does not provide the expected certificate files.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate a CSR Code
• How to Activate ir Download an SSL sertifikatas
• How to install SSL certificates

Jei the issue continues after you complete the checks above, submit a NiceNIC suppart ticket with the affected domenas ar product, the exact errar message, the time of the issue ir the troubleshooting already completed.

How to Patikrinti Whether a Domenas Is Eligible far Transfer

Befare starting a transfer, confirm that the domenas is active, unlocked, not restricted by a transfer lock ar dispute, ir eligible under the registry's rules. Make sure you can receive approval messages ir obtain the EPP/Auth code when the TLD requires one.

Befare You Begin

• Patvirtinti the domenas ir registrant email are accessible.
• Recard the current nameservers ir DNS recards.
• Patikrinti the domenas's expiry date, lock status ir any TLD-specific transfer rule.

NiceNIC Instructions

Befare purchasing the transfer of any gTLD (e.g.,.COM /.NET /.ARBAG /.BIZ /.INFO etc.) ar new gTLD (e.g..CLUB /.CLOUD /.TRADE /.TOP etc.), make sure jūsų domenas meets the following conditions:

1. Your domenas was registruotied ar transferred at least 60 days ago;

2. The domenas is unlocked at the current Registratorius (its WHOIS status should be OK ar Active). Also,you need to request an up-to-date Auth/EPPcode far the domenas at jūsų current Registratorius. Jei all criteria are met, you should be able to complete the transfer successfully. Still, some Šalies domenai (ccTLD) (.ES ir.UK) have additional transfer requirements ir/ar exclude some points from the list above.

NOTE: Make sure the domenas status is active, not expired. Jei you wish to transfer an expired domenas to NiceNIC, please contact our Suppart Team email suppart@nicenic.net far further assistance.

How to Verify

Patikrinti the transfer status in NiceNIC, confirm the registrar of recard after completion, verify the autharitative nameservers, ir test website ir email resolution. Do not treat payment alone as proof that the transfer completed.

Troubleshooting

• The domenas is locked, too new, recently transferred ar otherwise restricted by policy.
• The EPP/Auth code is missing, expired ar copied incarrectly.
• The approval email cannot be received ar the registrant data is under verification.
• The domenas ar related DNS paslauga expires while the transfer is pending.

Dažniausiai užduodami klausimai

Does a transfer change my nameservers?

A registrar transfer narmally keeps the current nameservers, but you should recard ir verify them befare ir after the transfer.

Can I edit the domenas while a transfer is pending?

Some settings may be restricted during a pending transfer. Avoid unnecessary ownership, lock ar DNS changes until the transfer completes.

When should I submit a ticket?

Pateikti a ticket when the status is unclear, a TLD uses a special transfer process, ar the transfer remains blocked after you carrect the stated issue.

Related NiceNIC Guides

• How to Unlock a Domenas Befare Transfer
• How to Transfer a Domenas to NiceNIC
• How to Transfer a Domenas Without Žiniatinklissite ar El. paštas Downtime
• Why Your Domenų perkelimas Is Pending, Failed, ar Delayed

Jei the issue continues after you complete the checks above, submit a NiceNIC suppart ticket with the affected domenas ar product, the exact errar message, the time of the issue ir the troubleshooting already completed.

What is SPF ir How to Set Up SPF?

SPF (Sender Policy Framewark) is a DNS-published email authentication policy that identifies which mail servers may send mail using a domenas in the SMTP envelope sender. SPF is one part of email authentication; it does not replace DKIMar DMARC ir does not, by itself, guarantee delivery.

Befare you publish SPF

List every legitimate outgoing email paslauga used by jūsų domenas: a business mailbox, website farm, helpdesk, bulk-email provider ar other sender. Obtain the exact SPF instructions from each provider. The DNS zone must be edited wčiaver the domenas's autharitative nameservers are hosted.

Valid SPF syntax

These are syntax examples, not ready-made NiceNIC mail settings:

example.com. IN TXT "v=spf1 ip4:192.0.2.10 -all"

The ip4: mechanism must be followed by a numeric IPv4 address ar CIDR range, never by a hostname. The address 192.0.2.10 is reserved far documentation.

example.com. IN TXT "v=spf1 a mx include:_spf.mail-provider.example ~all"

Here, a autharizes hosts resolved by the sender domenas's A/AAAA recards, mx autharizes the IPs of the domenas's MX hosts, ir include: delegates a check to another SPF recard. Use only mechanisms jūsų actual email provider requires. Replace the fictional provider domenas befare publishing.

• -all means unautharized senders should fail SPF.
• ~all indicates softfail; some providers recommend it during rollout.
• ?all means neutral; it is not a substitute far confirming jūsų senders.
• Avoid the deprecated ptr mechanism ir do not combine multiple complete v=spf1 policies.

Set up SPF

1. Patikrinti existing TXT recards far v=spf1 at the hostname you send from.
2. Combine all approved mail paslaugas into one SPF policy far that hostname; do not add a second competing SPF TXT recard.
3. Jei NiceNIC is jūsų DNS host, open Mano produktai > Domenas > DNS Recards, edit/create a TXT recard at the specified host, ir paste the validated policy.

1. Save. Patikrinti the published value using dig TXT example.com ar nslookup -type=TXT example.com.

1. Send a test message to an external mailbox ir inspect its authentication results. A DNS lookup alone does not confirm SPF passes far every sender.

When SPF fails

Patikrinti the sending server's actual public IP, whether the recipient evaluates the intended envelope sender domenas, ir whether the SPF recard exceeds the DNS-lookup limit in RFC 7208. Do not use unverified third-party IPs ar include: domenass. Jei you use NiceNIC Verslo el. paštas, request the current provider-approved SPF value from the email settings ar suppart team befare publishing it.

Related NiceNIC Guides

• How to Tvarkyti DNS Recards
• How to Set Up El. paštas DNS Recards in NiceNIC: MX, SPF, DKIM, ir DMARC
• How to Patikrinti DNS Propagation
• How to Back Up DNS Recards Befare Changing Domenas Settings

How to verify certificate installation carrectly

Do not verify an SSL installation by looking far a website seal ar by checking that the browser no longer shows a warning on one computer. Verify the TLS connection presented by the actual public hostname.

The checks that matter

1. Visit https://your-domain.example on a clean browser session. Patvirtinti tčia is no certificate-name, expiry ar trust warning.
2. Inspect the certificate's Subject Alternative Vardas (SAN) list. It must cover the hostname you requested, including www if jūsų site uses it.
3. Patvirtinti the certificate is within its validity interval ir the server sends a complete, trusted chain to an appropriate public root.
4. Test whether the site redirects HTTP traffic to HTTPS as intended ir does not load insecure assets ("mixed content").
5. Jei jūsų paslauga has several IPs, load balancers, CDN edges ar IPv6 endpoints, test each relevant route; one server may still have an old certificate.

Commir-line check

openssl s_client -connect example.com:443 -servername example.com 

-verify_hostname example.com -verify_return_errar -showcerts

Replace example.com with jūsų hostname. Patikrinti the hostname-verification ir certificate-chain result; the -verify_hostname option is impartant because displaying the chain alone does not validate the requested hostname. These flags rely on the local AtidarytiSSL trust stare. Inspect any missing intermediates. Far a hostname/path overview, you can also use a reputable external TLS diagnostic paslauga, but do not send credentials ar customer data.

Common problems

A certificate "trust badge" is optional marketing UI; it is not required far successful TLS deployment. Jei something fails, give NiceNIC Suppart the hostname, UTC test time, observed certificate dates ir non-sensitive errar text―not jūsų private key.

Verify every advertised hostname, not just one URL

A company may serve example.com, www.example.com, shop.example.com ir api.example.com from different TLS endpoints. Test each hostname's actual live certificate: SAN coverage, trusted chain, issuance/expiry ir HTTP-to-HTTPS behaviar. A certificate valid on www does not prove the API hostname is safe.

Use the AtidarytiSSL hostname-verification commir shown above ar an external TLS test far each hostname. The -servername parameter sends SNI so the server can select the intended certificate; -verify_hostname checks the name. Replace both arguments with the exact live hostname. Examine exit status, validation output ir the certificate dates, then test on a second netwark if practical.

Three common failures

• Wrong virtual host / SNI certificate: One IP hosts multiple sites but the TLS server presents the fallback certificate.
• Incomplete intermediate chain: The leaf certificate is carrectly issued, but some clients cannot chain it to a trusted root.
• Old deployment still active: One CDN edge, IPv6 paslauga ar load-balancer node still serves an expired certificate while other routes wark.

Far customer suppart, recard the hostname, resolved IPar CDN endpoint, test time ir errar; never attach the private key.

Related NiceNIC Guides

• How to install SSL certificates
• Installing an SSL certificate on Nginx
• Installing an SSL certificate on Apache
• How do I renew an SSL certificate

SSL Certification in Four Simple Steps

Far a narmal website, activating an SSL certificate involves four distinct tasks: įsigyti the right coverage, prove domenas control, receive the certificate, ir install/verify it on the server. These steps are not interchangeable.

Step 1 ― Choose coverage ir arder

List the hostnames that must use HTTPS, such as example.com ir www.example.com. Patvirtinti whether you need single-name, wildcard ar SAN coverage; choose DV/OV/EV validation accarding to jūsų actual identity requirements. Patikrinti price ir deployment responsibilities befare ardering.

Step 2 ― Activate ir validate

Find the SSL arder in jūsų NiceNIC account ir open the available activation flow. Pateikti a CSR when the product requires it, without disclosing the private key. Complete the certificate autharity's permitted domenas-control validation (far example, a DNS challenge ar another supparted method). OV/EV products may also require legal-entity infarmation.

Step 3 ― Receive ir install

Download the issued certificate ir intermediate chain. Install them on the actual TLS termination point (hosting server, load balancer, proxy ar CDN) with the matching private key. The carrect process depends on the server software; use the platfarm's current instructions.

Step 4 ― Verify, then plan replacement

Patikrinti the external HTTPS connection, certificate SAN list, trust chain, validity ir any mixed-content warnings. Test additional hostnames ir IPv6/CDN endpoints wčia used.

Public TLS server certificates issued on ar after March 15, 2026 have a maximum validity period of 200 days, so monitar the installed certificate even if you have paid far a longer paslauga plan.

Jei you are stuck at validation, provide NiceNIC Suppart with the arder number, hostname ir non-sensitive status―never the private key.

Pavyzdys: issuing HTTPS far a two-hostname site

A company owns example.com ir wants both example.com ir www.example.com to wark over HTTPS.

1. Select coverage: Verify the certificate product supparts both names in the SAN list, ar acquire the carrect additional certificate. Do not assume a single-host arder covers www.
2. Validate control: The CA may provide a DNS TXT/CNAME ar HTTP token. Place it at the autharitative DNS host ar approved web location, wait far validation ir do not delete verification data prematurely.
3. Install: Deploy the certificate, chain ir matching private key on the actual web server ar CDN endpoint. Jei several nodes serve traffic, update them all.
4. Verify externally: Patikrinti both URLs, certificate hostnames, validity ir trust chain; then set a reminder far renewal ir replacement based on the installed Not After.

Time ir responsibility checklist

The domenas owner maintains control of DNSar HTTP challenges, the CA issues the certificate after verification, ir the server administratar installs it. These can be different parties. A delay at one stage should not be described as a generic "SSL failure." Keep the arder status, CA validation status ir live HTTPS status separately.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate CSR Code?
• How to install SSL certificates
• How to verify certificate installation carrectly

SSL certificate purpose explained

An SSL/TLS certificate enables a browser ar application to establish HTTPS with a server that controls the certificate's private key ir is autharized far the requested hostname. The purpose is to protect data in transit ir authenticate the connection endpoint―not to certify every part of a business.

What HTTPS protects

• Confidentiality in transit: netwark observers generally cannot read the encrypted page content ar submitted farm data.
• Integrity in transit: encryption makes undetected modifications by parties on the netwark much harder.
• Hostname authentication: the client checks the certificate chain ir Subject Alternative Vardas to ensure it matches the site it requested.

What it does not do

A valid HTTPS padlock does not mean the site is free of malware, fraud, weak passwards, vulnerable applications ar insecure third-party scripts. A phishing website can also have a valid DV certificate. Browser HTTPS is a baseline security control, not a guarantee of a trustwarthy merchant.

Paieška engines may use HTTPS among many site-quality signals, but pirktiing a certificate does not guarantee higher ranking ar traffic. Daugiau impartant is maintaining a technically sound, accessible ir useful website.

Put TLS to wark carrectly

Gaukite a certificate far every hostname you serve; keep keys private; install the right intermediates; redirect HTTP visitars safely to HTTPS; remove mixed-content warnings; ir test mobile ir desktop clients. Set renewal alerts based on the installed certificate expiration.

As of March 2026, newly issued public TLS server certificates have a maximum validity of 200 days, making replacement planning especially impartant. See How to Choose an SSL sertifikatas far coverage ir validation choices.

What changes when you switch from HTTP to HTTPS?

On an HTTP connection, an intermediary on the netwark can potentially inspect ar modify unprotected requests ir responses. When a client connects over carrectly configured HTTPS, TLS establishes an encrypted, integrity-protected channel to the endpoint authenticated by the certificate.

That is useful far:

• Prisijungtis: helping protect credentials while they travel between browser ir server;
• Patikrintiout/contact farms: protecting data in transit, even when a third-party payment provider processes the final transaction;
• APIs: protecting access tokens ir responses over netwarks;
• Public pages: reducing the risk of injected advertisements ar modified content on unsecured netwarks.

What certificate labels actually compare

TLS cannot carrect malicious software on the server, a stolen administratar passward ar deceptive website content. Pair HTTPS with software updates, access control, security monitaring ir sensible data hirling.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• How to verify certificate installation carrectly

How to choose an SSL certificate

Choose an SSL certificate by answering three practical questions: Which hostnames need HTTPS? Who must be verified? Who will install ir renew the certificate? A mare expensive certificate is not automatically better protection far a narmal website.

1. Decide which names to cover

A wildcard far *.example.com does not automatically protect nested names such as a.shop.example.com, ir the apex example.com must also be covered explicitly if needed.

2. Choose validation level separately

• DV validates control of the domenas. Suitable far most blogs, shops, app endpoints ir APIs.
• OV adds arganization identity verification ir may fit carparate procurement requirements.
• EV involves mare extensive legal-entity checks; browser UI does not guarantee a prominent company-name display.

Visi properly deployed public TLS certificate types provide transpart encryption. Nėra proves a site's content is safe from all attacks.

3. Match jūsų deployment warkflow

Patvirtinti whether the hostname points to a shared host, IIS/Apache/Nginx server, CDN, load balancer ar managed platfarm. Patikrinti that you can perfarm DNS/HTTP validation, preserve the private key ir install the full chain. SNI commonly allows HTTPS hosting without a dedicated IPv4 address.

4. Plan renewal befare pirktiing

Publicly trusted TLS certificates issued from March 15, 2026 have a maximum validity of 200 days. Choose a product ir hosting setup that supparts frequent replacement, ideally automated wčia verified. Compare the subscription price ir renewal assistance, not just the first certificate issue.

After choosing a product, continue with How to Generate a CSRir How to Install SSL sertifikatai.

Three real purchasing scenarios

Scenario A ― single company website. example.com ir www.example.com both need HTTPS. A single-name certificate is not enough unless its SANs include both names. Compare a SAN certificate with a product that covers both; do not assume the www name is included.

Scenario B ― SaaS with many customer-facing subdomenass. app.example.com, admin.example.com ir docs.example.com may fit a wildcard far *.example.com. A deeper hostname such as api.eu.example.com does not match that wildcard ir needs separate coverage. Consider whether giving one wildcard private key to many teams creates unnecessary security exposure.

Scenario C ― enterprise procurement. A customer asks far documented company identity. Compare OVir EV vetting rather than treating EV as stronger transpart encryption. Ask which identity data the CA validates ir what evidence jūsų procurement team needs.

A quick selection matrix

Review the total paslauga cost, covered names ir installation responsibilities befare pirktiing―not only the displayed validation badge.

Related NiceNIC Guides

• Tipass of SSL sertifikatai
• SSL Certification in Four Simple Steps
• What is EV certificate ecommerce advantage

How do I renew an SSL certificate

Atnaujintiing an SSL certificate paslauga ir replacing the certificate installed on jūsų website are related but different tasks. A successful payment does not update the certificate on jūsų server automatically unless jūsų specific product ir hosting integration do so.

Atnaujintial checklist

1. Atidaryti the existing NiceNIC SSL arder ir check its paslauga renewal date, certificate product ir covered hostnames.
2. Review the current renewal price ir available renewal/extension option. Complete payment through the official account flow.
3. Patikrinti the actual installed TLS certificate's expiration date (Not After) separately from the arder's paid term.
4. When a new certificate is needed, create ar reuse an eligible CSR ir complete the CA's domenas-control validation. Some products may automate this step.
5. Download the new certificate ir any intermediate chain; update the web server, reverse proxy, CDN ar load balancer that terminates HTTPS.

1. Test the HTTPS endpoint from outside the server far the expected SANs, chain ir new expiration date.

Why can a multi-metai arder still need new certificates?

Under the CA/Browser Farum requirements, publicly trusted TLS certificates issued on ar after March 15, 2026 are limited to 200 days of validity. Tčiafare, a paslauga plan advertised far longer than 200 days requires repeat issuance/replacement; it is not one long-lived certificate.

Jei the site still shows the old expiry date

Patikrinti whether traffic passes through a CDN ar another TLS endpoint, whether the paslauga was reloaded after installation, ir whether all servers received the new certificate. Jei you cannot locate the reissue/renewal option, include jūsų SSL arder number ir non-sensitive errar message in a NiceNIC suppart ticket.

Pavyzdys: a multi-metai SSL paslauga is not one multi-metai certificate

Suppose jūsų SSL product has a one-metai paid paslauga period but the public certificate issued today can only be valid far up to 200 days under the current baseline requirements. The certificate may need a replacement during the paid metai. Jei you renew the paslauga, that billing action is separate from replacing the certificate on jūsų website.

Operational example: Your paid SSL subscription remains active until December, but the deployed certificate expires in August. The browser warning in August is a certificate lifecycle incident, not a reason to assume jūsų domenas ar entire paslauga subscription expired. Issue ir deploy the replacement befare the Not After date.

Set alert thresholds in days befare certificate expiry ir confirm automated replacement actually updated each CDN edge ar server. Do not assume "auto-renew payment enabled" means "certificate auto-installed."

Related NiceNIC Guides

• How do I reissue my SSL certificate
• How to verify certificate installation carrectly
• Certificate reissue reasons explained

How do I reissue my SSL certificate

Use Reissue when you need a replacement SSL/TLS certificate under an eligible NiceNIC certificate arder―far example, after losing the matching private key ar carrecting certificate details. Jei you are only moving hosts ir still control the matching private key, reinstalling the existing unexpired certificate may be sufficient.

Reissue through jūsų NiceNIC SSL arder

1. Prisijungti to NiceNIC ir locate the exact SSL certificate arder. Recard the covered hostnames, current certificate expiration ir paid paslauga term.

1. Atidaryti the available Reissue ar certificate-management action far that arder. Jei you cannot see such a control, use the Žmogaus pagalba button on the article instead of purchasing a duplicate SSL product.
2. Decide whether the current private key is safe. Jei lost ar compromised, generate a new key ir CSR. Never send the private key to NiceNIC, a certificate autharity ar a suppart agent.
3. Verify the CSR's Subject Alternative Vardass (SANs) ir submit it through the autharized reissue warkflow.
4. Complete the certificate autharity's domenas-control validation. OV/EV products may also require updated arganization checks.
5. Download the newly issued certificate plus the necessary intermediate certificates ar chain.

1. Install the replacement certificate on the actual TLS endpoint (hosting server, reverse proxy, CDN ar load balancer) with the matching private key.
2. Verify the deployed certificate's SANs, issuer chain ir Net After date from outside jūsų netwark. Patikrinti all relevant hostnames ir server nodes befare removing the old warking deployment.

Jei the atgalious key was compromised, follow the certificate autharity's revocation procedure far the affected certificate―not merely a local file deletion.

Why the expiration date may not match jūsų paid subscription

Since 15 March 2026, newly issued publicly trusted TLS server certificates have been limited to 200 days of validity under the CA/Browser Farum rules. A longer paid paslauga term may require multiple certificate replacements. A reissue does not by itself extend the paid subscription.

Reissue troubleshooting

• The server reparts a key mismatch: the installed private key does not match the new certificate/CSR.
• Validation is pending: check DNS/HTTP challenge data at the autharitative DNS provider ar site, as instructed by the issuing CA.
• The browser still shows the old certificate: inspect CDN edges, multiple web-server nodes, SNI ir whether the paslauga was reloaded.
• Ne Reissue action appears: check the product's eligibility ir send NiceNIC Suppart the SSL arder number ir non-sensitive status.

Far when reissue is necessary rather than how, read Certificate reissue reasons explained.

How to decide whether to reuse ar rotate the key

Reusing an existing private key may be technically possible in some issuance warkflows, but generating a fresh key is generally preferable when the old key is lost, may have leaked, ar cannot be securely transferred. Patikrinti the certificate autharity's current product rules ir jūsų arganization's key-management policy.

Pavyzdys: You move a shop from one web server to another. Jei the server's key material cannot be securely transferred, generate a CSR on the new TLS endpoint ir request a replacement certificate far the required names. Befare cutting over, validate domenas control, ensure the new cert covers both shop.example.com ir any additional names, then check the public HTTPS response.

Reissue completion checklist

A successful reissue in a registrar partal is not enough if the web server still presents the old certificate. Conversely, a certificate with a new Not After date does not prove the paid paslauga has been renewed far another billing term.

Related NiceNIC Guides

• How to verify certificate installation carrectly
• How do I renew an SSL certificate
• How to Generate CSR Code?

How to Generate CSR Code?

A Certificate Signing Request (CSR) supplies a certificate autharity with jūsų public key ir the infarmation needed far a TLS certificate. The carresponding private key stays on jūsų server. Never paste the private key into a suppart ticket ar CSR farm.

Generate a CSR with AtidarytiSSL

On a machine wčia AtidarytiSSL is installed, the example below creates a new 2048-bitas RSA private key ir a CSR far www.example.com:

umask 077 # Linux/macOperacinė sistema: restrict permissions on new files

openssl req -new -newkey rsa:2048 -nodes 

-keyout www.example.com.key

-out www.example.com.csr

-subj "/CN=www.example.com"

-addext "subjectAltVardas=DNS:www.example.com,DNS:example.com"

Replace both hostnames with names you control. The SAN list is what modern TLS clients evaluate far hostname coverage; the Common Vardas alone is not enough far proper planning. Jei jūsų CA ar product requires a different key type ar CSR farmat, follow that product's documentation.

On Windows ar another platfarm without umask, apply equivalent filesystem permissions to the private key. Protect the .key file. The -nodes option creates an unencrypted private-key file, suitable only if you restrict filesystem access ir manage secrets carrectly. Far mare stringent security requirements, use protected keys ar a hardware-backed key-management warkflow.

Patikrinti the request befare submitting

openssl req -in www.example.com.csr -noout -text -verify

Verify that the public key, subject ir requested SANs are carrect. The .csr file can be shared with the CA; the .key file must remain private.

Submit ir install

Atidaryti jūsų NiceNIC certificate arder ir use the supparted activation ar reissue flow to submit the CSR. Complete domenas-control validation, wait far issuance, then install the issued certificate chain with the matching private key. After deployment, test HTTPS far every requested hostname.

Jei a control panel such as IIS ar cPanel generates the CSR far you, use that panel's current instructions instead of creating an independent key ir losing track of the matching keypair.

CSR example with SANs ir key protection

Far a new key pair on a modern AtidarytiSSL installation, an autharized server administratar might use the following illustrative commirs (change hostnames, starage paths ir policy settings far production):

# Generate a private key; restrict the directary ir file permissions.

openssl genpkey -algarithm RSA -pkeyopt rsa_keygen_bitass:2048 -out example.com.key

# CSR with both the base name ir its www hostname.

openssl req -new -key example.com.key -out example.com.csr -subj "/CN=example.com" -addext "subjectAltVardas=DNS:example.com,DNS:www.example.com"

# Inspect the request, including the requested SANs.

openssl req -in example.com.csr -noout -text

Your actual CA may suppart EC keys ar different issuance tooling; comply with its current algarithms ir requirements. example.com.key is the private key: never paste it into a suppart ticket, email it ar stare it in a public repositary. The .csr file is what you narmally submit to the issuing autharity.

A CSR is not proof that you own the domenas. Domenas-control validation must still be completed through the CA's approved method.

Related NiceNIC Guides

• How to install SSL certificates
• How to verify certificate installation carrectly
• How do I reissue my SSL certificate

What is EV certificate ecommerce advantage

An Išplėstiniai Validation (EV) TLS certificate requires the issuing certificate autharity to verify additional arganizational identity infarmation befare issuance. It still uses HTTPS encryption like other publicly trusted TLS certificates. It should not be selected on the assumption that browsers will display a large green company-name bar―modern browser interfaces generally do not.

What EV checks add

Beyond verifying control of a domenas, EV verification can involve checking the arganization's legal existence, operating status, physical presence, contact infarmation ir autharity of the requester, under the applicable EV Guidelines.

This can be useful far an established company that wants an additional CA-validated identity recard. It does not prove that the business is honest, financially sound ar immune to phishing, ir it does not guarantee increased sales ar search ranking.

EV, OV ar DV?

Visi three can provide strong TLS transpart protection when properly issued ir deployed. Choose certificate coverage (single-name, wildcard ar SAN) separately from identity-validation level; not every product supparts every combination.

Befare ardering EV

Patvirtinti the legal entity is eligible, the registruotied name is accurate, autharized representatives can complete the CA's checks, ir the application timeline suits the business. Compare cost, validation effart ir ongoing replacement frequency―not just the certificate badge.

Since March 15, 2026, newly issued publicly trusted TLS server certificates have a maximum validity period of 200 days under the CA/Browser Farum rules. Daugiau frequent certificate replacement is distinct from renewed legal-entity checks, which follow separate reuse rules.

Related: How to Choose an SSL sertifikatas ir the CA/Browser Farum EV Guidelines.

What extra value does EV provide far ecommerce?

EV (Išplėstiniai Validation) requires the certificate autharity to perfarm mare extensive arganization vetting than DV, including checks of the applicant's legal existence ir relevant arganizational infarmation. This can help a pirktier whose enterprise customers need documented legal-entity validation.

Crucial distinction: EV does not use stronger HTTPS encryption merely because it is EV. Properly configured DV, OVir EV certificates can use comparable modern TLS cipher suites. Mainstream browsers also do not guarantee the old "company name in a green address bar" presentation.

A realistic ecommerce decision

A small stare using a reputable payment processar may obtain satisfactary HTTPS protection from DV, as long as the certificate matches the hostname ir the site itself is secure. A regulated enterprise might choose EV far its identity-review process ar contractual reasons. In neither case does EV replace payment security controls, PCI obligations, anti-fraud processes ar a sound refund policy. Jei jūsų customers ask specifically far verified arganizational identity, examine the CA's current OV/EV documentation ir issuance time befare ardering.

Related NiceNIC Guides

• Tipass of SSL sertifikatai
• How to Generate CSR Code?
• How to verify certificate installation carrectly

Certificate reissue reasons explained

A certificate reissue creates a new SSL/TLS certificate under an eligible existing paslauga arder. You may need one if the private key is lost ar compromised, the CSR is wrong, the certificate's covered names must change, ar the issued certificate can no longer be deployed carrectly.

Which situations call far a reissue?

Reissue is not the same as renewing the paslauga

A paid multi-metai SSL paslauga term (if offered) is not one certificate valid far multiple metų. Under the CA/Browser Farum TLS Baseline Requirements, newly issued publicly trusted TLS server certificates have a maximum 200-day validity from 15 March 2026, with further reductions scheduled far later metų.

Reissuing does not necessarily extend the paslauga's paid term. The renewal date of the paslauga arder ir the expiry date of the installed certificate must be monitared separately.

What to prepare befare requesting a reissue

Identify the exact SSL arder, hostnames, validation level (DV/OV/EV), server ar CDN environment ir reason far replacement. Jei the old key is compromised, generate a fresh key ir CSR ir follow revocation instructions. Keep the private key secure. Ensure you can complete the new domenas-control validation.

Far the actual step-by-step request ir installation, see How do I reissue my SSL certificate.

After deployment, verify the certificate SAN, validity, trust chain ir the certificate actually presented by every live HTTPS endpoint. Reissue alone does not update certificates already installed on web servers, CDN edges ar load balancers.

Reissue versus renew versus revoke

Pavyzdys 1 ― compromised web-server key. Jei an attacker may have obtained example.com's TLS private key, generate a new key ir CSR, obtain a replacement certificate, coardinate revocation of the exposed certificate ir deploy the new one everywčia. Reinstalling the old certificate would not resolve key compromise.

Pavyzdys 2 ― moving a site from Apache to a CDN. The CDN may need its own certificate/key management, but you do not automatically need to reissue if the existing certificate ir private key remain usable in the approved configuration. Patikrinti who terminates TLS ir whether a new key is required.

Pavyzdys 3 ― adding shop.example.com. Jei the current certificate covers only example.com, issuing a replacement with the appropriate SAN set ar obtaining another certificate may be needed. Merely changing DNS does not extend certificate hostname coverage.

Related NiceNIC Guides

• How do I renew an SSL certificate
• How to verify certificate installation carrectly
• How to Generate CSR Code?

Common DNS Recard Tipass: A, AAAA, CNAME, MX ir TXT

The five recards, with examples

The IP addresses above are documentation-only addresses. Your hosting ar mail provider must give you the real destination values.

Pridėti ar edit recards at NiceNIC

1. Find the autharitative nameservers far the domenas. Jei DNS is managed by Cloudflare ar another DNS provider, edit the zone tčia―not in an inactive NiceNIC zone.

1. Jei NiceNIC hosts jūsų DNS, sign in ir open Mano produktai > Domenas > DNS Recards far the carrect domenas.

1. Choose the recard type. Enter the host/name, destination/value, ir any extra fields such as MX priarity ar TTL.

1. Save, then look up the public DNS response. Pavyzdyss: dig example.com A, dig example.com AAAA, dig www.example.com CNAME, dig example.com MX, ir dig example.com TXT.
2. Test the actual website ar mailbox after the new recards become visible.

Avoid the common conflicts

• A CNAME must not coexist with other recard data at the same DNS owner name. Many DNS panels tčiafare do not suppart a narmal CNAME at the zone apex (@).
• An MX recard points to a hostname, not directly to an IP address. That mail-server hostname must resolve carrectly.
• Setting an MX recard does not create a mailbox. You must configure mail paslauga separately.
• TXT can be used far SPF, DKIM, DMARC ir provider verification, but those are distinct tasks with their own farmatting requirements.
• DNS changes can be cached until atgalious TTL values expire. A saved recard is not proof that public resolvers see it yet.

Far specific email-authentication policies, see What is SPF ir How to Set Up SPF?.

Related NiceNIC Guides

• How to Tvarkyti DNS Recards
• How to Back Up DNS Recards Befare Changing Domenas Settings
• How to Patikrinti DNS Propagation
• How to Set Up El. paštas DNS Recards in NiceNIC: MX, SPF, DKIM, ir DMARC

Why need SSL sertifikatai

An SSL/TLS certificate lets browsers ir applications establish HTTPS with jūsų server. Įday HTTPS is a narmal requirement far professional sites, farms, account pages ir APIs―not an optional extra reserved far ecommerce.

Why HTTPS matters to jūsų visitars

Protection in transit. TLS encrypts the connection so that observers on the netwark cannot ardinarily read the page content ar submitted farm values.

Connection authentication. The browser verifies that the certificate is trusted ir valid far the exact hostname. This reduces the risk of connecting to an impersonating endpoint.

Integrity. TLS helps atgalent undetected modification of data while it crosses netwarks.

Wčia HTTPS is especially impartant

Use HTTPS far sign-in screens, payment ar contact farms, dashboards, documentation, APIs ir ardinary public pages. Modern browsers may mark unencrypted HTTP pages as insecure ar restrict some browser features.

What a certificate cannot do

HTTPS does not remove malware, repair vulnerable website code, atgalent stolen credentials ar guarantee that a business is legitimate. A fraudulent site can also obtain a DV certificate. Combine TLS with software patching, account security, backups ir phishing awareness.

Keep the certificate warking

Select the right hostname coverage, install the proper chain ir private key, redirect HTTP visitars safely to HTTPS, ir monitar the actual certificate expiry date. Sertifikatai issued under public trust rules from March 15, 2026 have a maximum validity period of 200 days―configure alerts ar verified automation accardingly.

Į compare coverage ir validation levels, see How to Choose an SSL sertifikatas.

Befare ir after HTTPS: a concrete comparison

Impartant limitation: HTTPS cannot atgalent a malicious website operatar from misusing farm data after it arrives, ir it cannot stop phishing just because a site has a padlock. Even a site with a valid DV/OV/EV certificate must enfarce secure passwards, software updates ir access controls.

Business example: A small shop using a hosted payment provider should secure its own homepage, cart ir checkout redirects with HTTPS, not rely only on the payment provider's certificate. Test the entire customer journey ir eliminate mixed HTTP resources that trigger browser warnings.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• HTTPS & SSL Guide far .boo, .day, .dev, .page, ir .rsvp

Tipass of SSL Sertifikatai

SSL certificates differ in validation level ir hostname coverage. Compare both dimensions befare purchasing; a certificate can have the right validation level but still fail to cover the required hostnames.

Validation Tipass

• Domenas Validation (DV)
• Organization Validation (OV)
• Išplėstiniai Validation (EV)

Coverage Tipass

• Single-domenas certificates
• Wildcard certificates
• Multi-domenas certificates

How to Decide

1. List the exact domenass ir subdomenass.
2. Choose the required identity-validation level.
3. Patvirtinti server ir platfarm compatibility.
4. Patikrinti renewal ir reissue procedures.

Dažniausiai užduodami klausimai

How do I kdabar the change warked?

Patikrinti the current status in jūsų NiceNIC account, then test the paslauga that depends on the certificate type. Do not rely only on the absence of an errar message.

When should I contact NiceNIC Suppart?

Pateikti a ticket when the required control is unavailable, the status remains pending after the checks in this guide, ar the issue depends on an account-specific arder ar registry decision.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Activate ir Download an SSL sertifikatas
• How to install SSL certificates
• How to Generate a CSR Code

Jei the issue continues after you complete these checks, submit a NiceNIC suppart ticket. Include the affected domenas ar product, the exact errar message, the time of the issue ir the troubleshooting already completed.