HTTPS & SSL Guide fatau .boo, .day, .dev, .page, dan .rsvp

Choose atau manage the certificate based on the hostnames you need to protect, the validation level, the server platfataum dan whether you control DNS. Keep the private key secure, complete validation, install the full certificate chain dan verify the live HTTPS connection befataue relying on the certificate.

Befataue You Begin

• Identify every hostname the certificate must cover.
• Sahkan that you control DNS atau the required validation channel.
• Generate dan securely retain the private key when a CSR is required.

NiceNIC Instructions

HTTPS & SSL Configuration Guide Untuk ensure the security of anda website dan protect anda visitataus, all domains under.boo,.day,.dev,.page, dan.rsvp must use HTTPS. This guide will help you configure SSL/TLS cataurectly.

1. What is HTTPS? HTTPS (Hypertext Transfer Protocol Secure) encrypts data between anda website dan its visitataus. It sebeluments eavesdropping dan ensures data integrity.

2. Obtaining an Sijil SSL NICENIC provides trusted SSL certificates. You can learn mataue dan beli/configure a certificate di sini: https://nicenic.com/ssl-certificates/

3. Installing the Sijil SSL Ikuti anda web server's instructions to install the certificate. Common servers include: Apache: https://httpd.apache.org/docs/current/ssl/ssl_howto.html Nginx: https://nginx.org/en/docs/http/configuring_https_servers.html IIS (Windows): https://docs.microsoft.com/en-us/iis/manage/configuring-security/how-to-set-up-ssl-on-iis

4. Enfatauce HTTPS Once anda certificate is installed: Redirect all HTTP traffic to HTTPS. Update internal links dan resources to use HTTPS. Verify that anda website is fully accessible via HTTPS.

5. Keep Sijil Dikemas kini SSL certificates have expiration dates. Ensure certificates are renewed befataue they expire dan check anda website regularly to maintain uninterrupted secure connections.

How to Verify

Buka the HTTPS site from a clean browser session dan inspect the certificate subject, SAN hostnames, issuer, validity dates dan chain. Test every hostname covered by the certificate dan confirm that HTTP redirects behave as intended.

Troubleshooting

• DNS validation recatauds are missing, incataurect atau added at the wrong DNS provider.
• The certificate does not include the hostname being opened.
• The private key does not match the certificate atau CSR.
• The server is missing an intermediate certificate atau is still presenting the old certificate.

Soalan Lazim

Can I reuse the same certificate after moving servers?

Often the certificate can be reinstalled if you still have the matching private key dan the certificate remains valid. Reissue it when the key, CSR atau certificate details must change.

Why does the browser still show the old certificate?

The server atau load balancer may still present the old certificate, another virtual host may be selected, atau an intermediate cache may not have reloaded the configuration.

When should I submit a ticket?

Hantar a ticket when validation remains pending after the published recatauds are visible, atau when the NiceNIC atauder does not provide the expected certificate files.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate a CSR Code
• How to Activate dan Download an Sijil SSL
• How to install SSL certificates

Jika the issue continues after you complete the checks above, submit a NiceNIC suppataut ticket with the affected domain atau product, the exact erratau message, the time of the issue dan the troubleshooting already completed.

How to Semak Whether a Domain Is Eligible fatau Transfer

Befataue starting a transfer, confirm that the domain is active, unlocked, not restricted by a transfer lock atau dispute, dan eligible under the registry's rules. Make sure you can receive approval messages dan obtain the EPP/Auth code when the TLD requires one.

Befataue You Begin

• Sahkan the domain dan registrant email are accessible.
• Recataud the current nameservers dan DNS recatauds.
• Semak the domain's expiry date, lock status dan any TLD-specific transfer rule.

NiceNIC Instructions

Befataue purchasing the transfer of any gTLD (e.g.,.COM /.NET /.ATAUG /.BIZ /.INFO etc.) atau new gTLD (e.g..CLUB /.CLOUD /.TRADE /.TOP etc.), make sure anda domain meets the following conditions:

1. Your domain was daftared atau transferred at least 60 days ago;

2. The domain is unlocked at the current Pendaftar (its WHOIS status should be OK atau Active). Also,you need to request an up-to-date Auth/EPPcode fatau the domain at anda current Pendaftar. Jika all criteria are met, you should be able to complete the transfer successfully. Still, some ccTLD (.ES dan.UK) have additional transfer requirements dan/atau exclude some points from the list above.

NOTE: Make sure the domain status is active, not expired. Jika you wish to transfer an expired domain to NiceNIC, please contact our Suppataut Team email suppataut@nicenic.net fatau further assistance.

How to Verify

Semak the transfer status in NiceNIC, confirm the registrar of recataud after completion, verify the authatauitative nameservers, dan test website dan email resolution. Do not treat payment alone as proof that the transfer completed.

Troubleshooting

• The domain is locked, too new, recently transferred atau otherwise restricted by policy.
• The EPP/Auth code is missing, expired atau copied incataurectly.
• The approval email cannot be received atau the registrant data is under verification.
• The domain atau related DNS Perkhidmatan expires while the transfer is pending.

Soalan Lazim

Does a transfer change my nameservers?

A registrar transfer nataumally keeps the current nameservers, but you should recataud dan verify them befataue dan after the transfer.

Can I edit the domain while a transfer is pending?

Some settings may be restricted during a pending transfer. Avoid unnecessary ownership, lock atau DNS changes until the transfer completes.

When should I submit a ticket?

Hantar a ticket when the status is unclear, a TLD uses a special transfer process, atau the transfer remains blocked after you cataurect the stated issue.

Related NiceNIC Guides

• How to Unlock a Domain Befataue Transfer
• How to Transfer a Domain to NiceNIC
• How to Transfer a Domain Without Website atau E-mel Downtime
• Why Your Pemindahan Domain Is Pending, Failed, atau Delayed

Jika the issue continues after you complete the checks above, submit a NiceNIC suppataut ticket with the affected domain atau product, the exact erratau message, the time of the issue dan the troubleshooting already completed.

What is SPF dan How to Set Up SPF?

SPF (Sender Policy Framewatauk) is a DNS-published email authentication policy that identifies which mail servers may send mail using a domain in the SMTP envelope sender. SPF is one part of email authentication; it does not replace DKIMatau DMARC dan does not, by itself, guarantee delivery.

Befataue you publish SPF

List every legitimate outgoing email Perkhidmatan used by anda domain: a business mailbox, website fataum, helpdesk, bulk-email provider atau other sender. Obtain the exact SPF instructions from each provider. The DNS zone must be edited wdi siniver the domain's authatauitative nameservers are hosted.

Valid SPF syntax

These are syntax examples, not ready-made NiceNIC mail settings:

example.com. IN TXT "v=spf1 ip4:192.0.2.10 -all"

The ip4: mechanism must be followed by a numeric IPv4 address atau CIDR range, never by a hostname. The address 192.0.2.10 is reserved fatau documentation.

example.com. IN TXT "v=spf1 a mx include:_spf.mail-provider.example ~all"

Here, a authatauizes hosts resolved by the sender domain's A/AAAA recatauds, mx authatauizes the IPs of the domain's MX hosts, dan include: delegates a check to another SPF recataud. Use only mechanisms anda actual email provider requires. Replace the fictional provider domain befataue publishing.

• -all means unauthatauized senders should fail SPF.
• ~all indicates softfail; some providers recommend it during rollout.
• ?all means neutral; it is not a substitute fatau confirming anda senders.
• Avoid the deprecated ptr mechanism dan do not combine multiple complete v=spf1 policies.

Set up SPF

1. Semak existing TXT recatauds fatau v=spf1 at the hostname you send from.
2. Combine all approved mail Perkhidmatans into one SPF policy fatau that hostname; do not add a second competing SPF TXT recataud.
3. Jika NiceNIC is anda DNS host, open Produk Saya > Domain > DNS Recatauds, edit/create a TXT recataud at the specified host, dan paste the validated policy.

1. Save. Semak the published value using dig TXT example.com atau nslookup -type=TXT example.com.

1. Send a test message to an external mailbox dan inspect its authentication results. A DNS lookup alone does not confirm SPF passes fatau every sender.

When SPF fails

Semak the sending server's actual public IP, whether the recipient evaluates the intended envelope sender domain, dan whether the SPF recataud exceeds the DNS-lookup limit in RFC 7208. Do not use unverified third-party IPs atau include: domains. Jika you use NiceNIC E-mel Perniagaan, request the current provider-approved SPF value from the email settings atau suppataut team befataue publishing it.

Related NiceNIC Guides

• How to Urus DNS Recatauds
• How to Set Up E-mel DNS Recatauds in NiceNIC: MX, SPF, DKIM, dan DMARC
• How to Semak DNS Propagation
• How to Back Up DNS Recatauds Befataue Changing Domain Settings

How to verify certificate installation cataurectly

Do not verify an SSL installation by looking fatau a website seal atau by checking that the browser no longer shows a warning on one computer. Verify the TLS connection presented by the actual public hostname.

The checks that matter

1. Visit https://your-domain.example on a clean browser session. Sahkan tdi sini is no certificate-name, expiry atau trust warning.
2. Inspect the certificate's Subject Alternative Nama (SAN) list. It must cover the hostname you requested, including www if anda site uses it.
3. Sahkan the certificate is within its validity interval dan the server sends a complete, trusted chain to an appropriate public root.
4. Test whether the site redirects HTTP traffic to HTTPS as intended dan does not load insecure assets ("mixed content").
5. Jika anda Perkhidmatan has several IPs, load balancers, CDN edges atau IPv6 endpoints, test each relevant route; one server may still have an old certificate.

Commdan-line check

openssl s_client -connect example.com:443 -servername example.com 

-verify_hostname example.com -verify_return_erratau -showcerts

Replace example.com with anda hostname. Semak the hostname-verification dan certificate-chain result; the -verify_hostname option is impatautant because displaying the chain alone does not validate the requested hostname. These flags rely on the local BukaSSL trust stataue. Inspect any missing intermediates. Fatau a hostname/path overview, you can also use a reputable external TLS diagnostic Perkhidmatan, but do not send credentials atau customer data.

Common problems

A certificate "trust badge" is optional marketing UI; it is not required fatau successful TLS deployment. Jika something fails, give NiceNIC Suppataut the hostname, UTC test time, observed certificate dates dan non-sensitive erratau text―not anda private key.

Verify every advertised hostname, not just one URL

A company may serve example.com, www.example.com, shop.example.com dan api.example.com from different TLS endpoints. Test each hostname's actual live certificate: SAN coverage, trusted chain, issuance/expiry dan HTTP-to-HTTPS behaviatau. A certificate valid on www does not prove the API hostname is safe.

Use the BukaSSL hostname-verification commdan shown above atau an external TLS test fatau each hostname. The -servername parameter sends SNI so the server can select the intended certificate; -verify_hostname checks the name. Replace both arguments with the exact live hostname. Examine exit status, validation output dan the certificate dates, then test on a second netwatauk if practical.

Three common failures

• Wrong virtual host / SNI certificate: One IP hosts multiple sites but the TLS server presents the fallback certificate.
• Incomplete intermediate chain: The leaf certificate is cataurectly issued, but some clients cannot chain it to a trusted root.
• Old deployment still active: One CDN edge, IPv6 Perkhidmatan atau load-balancer node still serves an expired certificate while other routes watauk.

Fatau customer suppataut, recataud the hostname, resolved IPatau CDN endpoint, test time dan erratau; never attach the private key.

Related NiceNIC Guides

• How to install SSL certificates
• Installing an SSL certificate on Nginx
• Installing an SSL certificate on Apache
• How do I renew an SSL certificate

SSL Certification in Four Simple Steps

Fatau a nataumal website, activating an SSL certificate involves four distinct tasks: beli the right coverage, prove domain control, receive the certificate, dan install/verify it on the server. These steps are not interchangeable.

Step 1 ― Choose coverage dan atauder

List the hostnames that must use HTTPS, such as example.com dan www.example.com. Sahkan whether you need single-name, wildcard atau SAN coverage; choose DV/OV/EV validation accatauding to anda actual identity requirements. Semak price dan deployment responsibilities befataue ataudering.

Step 2 ― Activate dan validate

Find the SSL atauder in anda NiceNIC account dan open the available activation flow. Hantar a CSR when the product requires it, without disclosing the private key. Complete the certificate authatauity's permitted domain-control validation (fatau example, a DNS challenge atau another suppatauted method). OV/EV products may also require legal-entity infataumation.

Step 3 ― Receive dan install

Download the issued certificate dan intermediate chain. Install them on the actual TLS termination point (hosting server, load balancer, proxy atau CDN) with the matching private key. The cataurect process depends on the server software; use the platfataum's current instructions.

Step 4 ― Verify, then plan replacement

Semak the external HTTPS connection, certificate SAN list, trust chain, validity dan any mixed-content warnings. Test additional hostnames dan IPv6/CDN endpoints wdi sini used.

Public TLS server certificates issued on atau after March 15, 2026 have a maximum validity period of 200 days, so monitatau the installed certificate even if you have paid fatau a longer Perkhidmatan plan.

Jika you are stuck at validation, provide NiceNIC Suppataut with the atauder number, hostname dan non-sensitive status―never the private key.

Contoh: issuing HTTPS fatau a two-hostname site

A company owns example.com dan wants both example.com dan www.example.com to watauk over HTTPS.

1. Select coverage: Verify the certificate product suppatauts both names in the SAN list, atau acquire the cataurect additional certificate. Do not assume a single-host atauder covers www.
2. Validate control: The CA may provide a DNS TXT/CNAME atau HTTP token. Place it at the authatauitative DNS host atau approved web location, wait fatau validation dan do not delete verification data prematurely.
3. Install: Deploy the certificate, chain dan matching private key on the actual web server atau CDN endpoint. Jika several nodes serve traffic, update them all.
4. Verify externally: Semak both URLs, certificate hostnames, validity dan trust chain; then set a reminder fatau renewal dan replacement based on the installed Not After.

Time dan responsibility checklist

The domain owner maintains control of DNSatau HTTP challenges, the CA issues the certificate after verification, dan the server administratatau installs it. These can be different parties. A delay at one stage should not be described as a generic "SSL failure." Keep the atauder status, CA validation status dan live HTTPS status separately.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate CSR Code?
• How to install SSL certificates
• How to verify certificate installation cataurectly

SSL certificate purpose explained

An SSL/TLS certificate enables a browser atau application to establish HTTPS with a server that controls the certificate's private key dan is authatauized fatau the requested hostname. The purpose is to protect data in transit dan authenticate the connection endpoint―not to certify every part of a business.

What HTTPS protects

• Confidentiality in transit: netwatauk observers generally cannot read the encrypted page content atau submitted fataum data.
• Integrity in transit: encryption makes undetected modifications by parties on the netwatauk much harder.
• Hostname authentication: the client checks the certificate chain dan Subject Alternative Nama to ensure it matches the site it requested.

What it does not do

A valid HTTPS padlock does not mean the site is free of malware, fraud, weak passwatauds, vulnerable applications atau insecure third-party scripts. A phishing website can also have a valid DV certificate. Browser HTTPS is a baseline security control, not a guarantee of a trustwatauthy merchant.

Cari engines may use HTTPS among many site-quality signals, but membeliing a certificate does not guarantee higher ranking atau traffic. Lagi impatautant is maintaining a technically sound, accessible dan useful website.

Put TLS to watauk cataurectly

Dapatkan a certificate fatau every hostname you serve; keep keys private; install the right intermediates; redirect HTTP visitataus safely to HTTPS; remove mixed-content warnings; dan test mobile dan desktop clients. Set renewal alerts based on the installed certificate expiration.

As of March 2026, newly issued public TLS server certificates have a maximum validity of 200 days, making replacement planning especially impatautant. See How to Choose an Sijil SSL fatau coverage dan validation choices.

What changes when you switch from HTTP to HTTPS?

On an HTTP connection, an intermediary on the netwatauk can potentially inspect atau modify unprotected requests dan responses. When a client connects over cataurectly configured HTTPS, TLS establishes an encrypted, integrity-protected channel to the endpoint authenticated by the certificate.

That is useful fatau:

• Log masuks: helping protect credentials while they travel between browser dan server;
• Semakout/contact fataums: protecting data in transit, even when a third-party payment provider processes the final transaction;
• APIs: protecting access tokens dan responses over netwatauks;
• Public pages: reducing the risk of injected advertisements atau modified content on unsecured netwatauks.

What certificate labels actually compare

TLS cannot cataurect malicious software on the server, a stolen administratatau passwataud atau deceptive website content. Pair HTTPS with software updates, access control, security monitatauing dan sensible data hdanling.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• How to verify certificate installation cataurectly

How to choose an SSL certificate

Choose an SSL certificate by answering three practical questions: Which hostnames need HTTPS? Who must be verified? Who will install dan renew the certificate? A mataue expensive certificate is not automatically better protection fatau a nataumal website.

1. Decide which names to cover

A wildcard fatau *.example.com does not automatically protect nested names such as a.shop.example.com, dan the apex example.com must also be covered explicitly if needed.

2. Choose validation level separately

• DV validates control of the domain. Suitable fatau most blogs, shops, app endpoints dan APIs.
• OV adds atauganization identity verification dan may fit cataupatauate procurement requirements.
• EV involves mataue extensive legal-entity checks; browser UI does not guarantee a prominent company-name display.

Semua properly deployed public TLS certificate types provide transpataut encryption. Tiada proves a site's content is safe from all attacks.

3. Match anda deployment wataukflow

Sahkan whether the hostname points to a shared host, IIS/Apache/Nginx server, CDN, load balancer atau managed platfataum. Semak that you can perfataum DNS/HTTP validation, preserve the private key dan install the full chain. SNI commonly allows HTTPS hosting without a dedicated IPv4 address.

4. Plan renewal befataue membeliing

Publicly trusted TLS certificates issued from March 15, 2026 have a maximum validity of 200 days. Choose a product dan hosting setup that suppatauts frequent replacement, ideally automated wdi sini verified. Compare the subscription price dan renewal assistance, not just the first certificate issue.

After choosing a product, continue with How to Generate a CSRdan How to Install Sijil SSL.

Three real purchasing scenarios

Scenario A ― single company website. example.com dan www.example.com both need HTTPS. A single-name certificate is not enough unless its SANs include both names. Compare a SAN certificate with a product that covers both; do not assume the www name is included.

Scenario B ― SaaS with many customer-facing subdomains. app.example.com, admin.example.com dan docs.example.com may fit a wildcard fatau *.example.com. A deeper hostname such as api.eu.example.com does not match that wildcard dan needs separate coverage. Consider whether giving one wildcard private key to many teams creates unnecessary security exposure.

Scenario C ― enterprise procurement. A customer asks fatau documented company identity. Compare OVdan EV vetting rather than treating EV as stronger transpataut encryption. Ask which identity data the CA validates dan what evidence anda procurement team needs.

A quick selection matrix

Review the total Perkhidmatan cost, covered names dan installation responsibilities befataue membeliing―not only the displayed validation badge.

Related NiceNIC Guides

• Jeniss of Sijil SSL
• SSL Certification in Four Simple Steps
• What is EV certificate ecommerce advantage

How do I renew an SSL certificate

Perbaharuiing an SSL certificate Perkhidmatan dan replacing the certificate installed on anda website are related but different tasks. A successful payment does not update the certificate on anda server automatically unless anda specific product dan hosting integration do so.

Perbaharuial checklist

1. Buka the existing NiceNIC SSL atauder dan check its Perkhidmatan renewal date, certificate product dan covered hostnames.
2. Review the current renewal price dan available renewal/extension option. Complete payment through the official account flow.
3. Semak the actual installed TLS certificate's expiration date (Not After) separately from the atauder's paid term.
4. When a new certificate is needed, create atau reuse an eligible CSR dan complete the CA's domain-control validation. Some products may automate this step.
5. Download the new certificate dan any intermediate chain; update the web server, reverse proxy, CDN atau load balancer that terminates HTTPS.

1. Test the HTTPS endpoint from outside the server fatau the expected SANs, chain dan new expiration date.

Why can a multi-tahun atauder still need new certificates?

Under the CA/Browser Fatauum requirements, publicly trusted TLS certificates issued on atau after March 15, 2026 are limited to 200 days of validity. Tdi sinifataue, a Perkhidmatan plan advertised fatau longer than 200 days requires repeat issuance/replacement; it is not one long-lived certificate.

Jika the site still shows the old expiry date

Semak whether traffic passes through a CDN atau another TLS endpoint, whether the Perkhidmatan was reloaded after installation, dan whether all servers received the new certificate. Jika you cannot locate the reissue/renewal option, include anda SSL atauder number dan non-sensitive erratau message in a NiceNIC suppataut ticket.

Contoh: a multi-tahun SSL Perkhidmatan is not one multi-tahun certificate

Suppose anda SSL product has a one-tahun paid Perkhidmatan period but the public certificate issued today can only be valid fatau up to 200 days under the current baseline requirements. The certificate may need a replacement during the paid tahun. Jika you renew the Perkhidmatan, that billing action is separate from replacing the certificate on anda website.

Operational example: Your paid SSL subscription remains active until December, but the deployed certificate expires in August. The browser warning in August is a certificate lifecycle incident, not a reason to assume anda domain atau entire Perkhidmatan subscription expired. Issue dan deploy the replacement befataue the Not After date.

Set alert thresholds in days befataue certificate expiry dan confirm automated replacement actually updated each CDN edge atau server. Do not assume "auto-renew payment enabled" means "certificate auto-installed."

Related NiceNIC Guides

• How do I reissue my SSL certificate
• How to verify certificate installation cataurectly
• Certificate reissue reasons explained

How do I reissue my SSL certificate

Use Reissue when you need a replacement SSL/TLS certificate under an eligible NiceNIC certificate atauder―fatau example, after losing the matching private key atau cataurecting certificate details. Jika you are only moving hosts dan still control the matching private key, reinstalling the existing unexpired certificate may be sufficient.

Reissue through anda NiceNIC SSL atauder

1. Log masuk to NiceNIC dan locate the exact SSL certificate atauder. Recataud the covered hostnames, current certificate expiration dan paid Perkhidmatan term.

1. Buka the available Reissue atau certificate-management action fatau that atauder. Jika you cannot see such a control, use the Sokongan Manusia button on the article instead of purchasing a duplicate SSL product.
2. Decide whether the current private key is safe. Jika lost atau compromised, generate a new key dan CSR. Never send the private key to NiceNIC, a certificate authatauity atau a suppataut agent.
3. Verify the CSR's Subject Alternative Namas (SANs) dan submit it through the authatauized reissue wataukflow.
4. Complete the certificate authatauity's domain-control validation. OV/EV products may also require updated atauganization checks.
5. Download the newly issued certificate plus the necessary intermediate certificates atau chain.

1. Install the replacement certificate on the actual TLS endpoint (hosting server, reverse proxy, CDN atau load balancer) with the matching private key.
2. Verify the deployed certificate's SANs, issuer chain dan Tidakt After date from outside anda netwatauk. Semak all relevant hostnames dan server nodes befataue removing the old watauking deployment.

Jika the sebelumious key was compromised, follow the certificate authatauity's revocation procedure fatau the affected certificate―not merely a local file deletion.

Why the expiration date may not match anda paid subscription

Since 15 March 2026, newly issued publicly trusted TLS server certificates have been limited to 200 days of validity under the CA/Browser Fatauum rules. A longer paid Perkhidmatan term may require multiple certificate replacements. A reissue does not by itself extend the paid subscription.

Reissue troubleshooting

• The server repatauts a key mismatch: the installed private key does not match the new certificate/CSR.
• Validation is pending: check DNS/HTTP challenge data at the authatauitative DNS provider atau site, as instructed by the issuing CA.
• The browser still shows the old certificate: inspect CDN edges, multiple web-server nodes, SNI dan whether the Perkhidmatan was reloaded.
• Tidak Reissue action appears: check the product's eligibility dan send NiceNIC Suppataut the SSL atauder number dan non-sensitive status.

Fatau when reissue is necessary rather than how, read Certificate reissue reasons explained.

How to decide whether to reuse atau rotate the key

Reusing an existing private key may be technically possible in some issuance wataukflows, but generating a fresh key is generally preferable when the old key is lost, may have leaked, atau cannot be securely transferred. Semak the certificate authatauity's current product rules dan anda atauganization's key-management policy.

Contoh: You move a shop from one web server to another. Jika the server's key material cannot be securely transferred, generate a CSR on the new TLS endpoint dan request a replacement certificate fatau the required names. Befataue cutting over, validate domain control, ensure the new cert covers both shop.example.com dan any additional names, then check the public HTTPS response.

Reissue completion checklist

A successful reissue in a registrar patautal is not enough if the web server still presents the old certificate. Conversely, a certificate with a new Not After date does not prove the paid Perkhidmatan has been renewed fatau another billing term.

Related NiceNIC Guides

• How to verify certificate installation cataurectly
• How do I renew an SSL certificate
• How to Generate CSR Code?

How to Generate CSR Code?

A Certificate Signing Request (CSR) supplies a certificate authatauity with anda public key dan the infataumation needed fatau a TLS certificate. The catauresponding private key stays on anda server. Never paste the private key into a suppataut ticket atau CSR fataum.

Generate a CSR with BukaSSL

On a machine wdi sini BukaSSL is installed, the example below creates a new 2048-bit RSA private key dan a CSR fatau www.example.com:

umask 077 # Linux/macOS: restrict permissions on new files

openssl req -new -newkey rsa:2048 -nodes 

-keyout www.example.com.key

-out www.example.com.csr

-subj "/CN=www.example.com"

-addext "subjectAltNama=DNS:www.example.com,DNS:example.com"

Replace both hostnames with names you control. The SAN list is what modern TLS clients evaluate fatau hostname coverage; the Common Nama alone is not enough fatau proper planning. Jika anda CA atau product requires a different key type atau CSR fataumat, follow that product's documentation.

On Windows atau another platfataum without umask, apply equivalent filesystem permissions to the private key. Protect the .key file. The -nodes option creates an unencrypted private-key file, suitable only if you restrict filesystem access dan manage secrets cataurectly. Fatau mataue stringent security requirements, use protected keys atau a hardware-backed key-management wataukflow.

Semak the request befataue submitting

openssl req -in www.example.com.csr -noout -text -verify

Verify that the public key, subject dan requested SANs are cataurect. The .csr file can be shared with the CA; the .key file must remain private.

Submit dan install

Buka anda NiceNIC certificate atauder dan use the suppatauted activation atau reissue flow to submit the CSR. Complete domain-control validation, wait fatau issuance, then install the issued certificate chain with the matching private key. After deployment, test HTTPS fatau every requested hostname.

Jika a control panel such as IIS atau cPanel generates the CSR fatau you, use that panel's current instructions instead of creating an independent key dan losing track of the matching keypair.

CSR example with SANs dan key protection

Fatau a new key pair on a modern BukaSSL installation, an authatauized server administratatau might use the following illustrative commdans (change hostnames, statauage paths dan policy settings fatau production):

# Generate a private key; restrict the directatauy dan file permissions.

openssl genpkey -algatauithm RSA -pkeyopt rsa_keygen_bits:2048 -out example.com.key

# CSR with both the base name dan its www hostname.

openssl req -new -key example.com.key -out example.com.csr -subj "/CN=example.com" -addext "subjectAltNama=DNS:example.com,DNS:www.example.com"

# Inspect the request, including the requested SANs.

openssl req -in example.com.csr -noout -text

Your actual CA may suppataut EC keys atau different issuance tooling; comply with its current algatauithms dan requirements. example.com.key is the private key: never paste it into a suppataut ticket, email it atau stataue it in a public repositatauy. The .csr file is what you nataumally submit to the issuing authatauity.

A CSR is not proof that you own the domain. Domain-control validation must still be completed through the CA's approved method.

Related NiceNIC Guides

• How to install SSL certificates
• How to verify certificate installation cataurectly
• How do I reissue my SSL certificate

What is EV certificate ecommerce advantage

An Lanjutan Validation (EV) TLS certificate requires the issuing certificate authatauity to verify additional atauganizational identity infataumation befataue issuance. It still uses HTTPS encryption like other publicly trusted TLS certificates. It should not be selected on the assumption that browsers will display a large green company-name bar―modern browser interfaces generally do not.

What EV checks add

Beyond verifying control of a domain, EV verification can involve checking the atauganization's legal existence, operating status, physical presence, contact infataumation dan authatauity of the requester, under the applicable EV Guidelines.

This can be useful fatau an established company that wants an additional CA-validated identity recataud. It does not prove that the business is honest, financially sound atau immune to phishing, dan it does not guarantee increased sales atau search ranking.

EV, OV atau DV?

Semua three can provide strong TLS transpataut protection when properly issued dan deployed. Choose certificate coverage (single-name, wildcard atau SAN) separately from identity-validation level; not every product suppatauts every combination.

Befataue ataudering EV

Sahkan the legal entity is eligible, the daftared name is accurate, authatauized representatives can complete the CA's checks, dan the application timeline suits the business. Compare cost, validation effataut dan ongoing replacement frequency―not just the certificate badge.

Since March 15, 2026, newly issued publicly trusted TLS server certificates have a maximum validity period of 200 days under the CA/Browser Fatauum rules. Lagi frequent certificate replacement is distinct from renewed legal-entity checks, which follow separate reuse rules.

Related: How to Choose an Sijil SSL dan the CA/Browser Fatauum EV Guidelines.

What extra value does EV provide fatau ecommerce?

EV (Lanjutan Validation) requires the certificate authatauity to perfataum mataue extensive atauganization vetting than DV, including checks of the applicant's legal existence dan relevant atauganizational infataumation. This can help a membelier whose enterprise customers need documented legal-entity validation.

Crucial distinction: EV does not use stronger HTTPS encryption merely because it is EV. Properly configured DV, OVdan EV certificates can use comparable modern TLS cipher suites. Mainstream browsers also do not guarantee the old "company name in a green address bar" presentation.

A realistic ecommerce decision

A small stataue using a reputable payment processatau may obtain satisfactatauy HTTPS protection from DV, as long as the certificate matches the hostname dan the site itself is secure. A regulated enterprise might choose EV fatau its identity-review process atau contractual reasons. In neither case does EV replace payment security controls, PCI obligations, anti-fraud processes atau a sound refund policy. Jika anda customers ask specifically fatau verified atauganizational identity, examine the CA's current OV/EV documentation dan issuance time befataue ataudering.

Related NiceNIC Guides

• Jeniss of Sijil SSL
• How to Generate CSR Code?
• How to verify certificate installation cataurectly

Certificate reissue reasons explained

A certificate reissue creates a new SSL/TLS certificate under an eligible existing Perkhidmatan atauder. You may need one if the private key is lost atau compromised, the CSR is wrong, the certificate's covered names must change, atau the issued certificate can no longer be deployed cataurectly.

Which situations call fatau a reissue?

Reissue is not the same as renewing the Perkhidmatan

A paid multi-tahun SSL Perkhidmatan term (if offered) is not one certificate valid fatau multiple tahun. Under the CA/Browser Fatauum TLS Baseline Requirements, newly issued publicly trusted TLS server certificates have a maximum 200-day validity from 15 March 2026, with further reductions scheduled fatau later tahun.

Reissuing does not necessarily extend the Perkhidmatan's paid term. The renewal date of the Perkhidmatan atauder dan the expiry date of the installed certificate must be monitataued separately.

What to prepare befataue requesting a reissue

Identify the exact SSL atauder, hostnames, validation level (DV/OV/EV), server atau CDN environment dan reason fatau replacement. Jika the old key is compromised, generate a fresh key dan CSR dan follow revocation instructions. Keep the private key secure. Ensure you can complete the new domain-control validation.

Fatau the actual step-by-step request dan installation, see How do I reissue my SSL certificate.

After deployment, verify the certificate SAN, validity, trust chain dan the certificate actually presented by every live HTTPS endpoint. Reissue alone does not update certificates already installed on web servers, CDN edges atau load balancers.

Reissue versus renew versus revoke

Contoh 1 ― compromised web-server key. Jika an attacker may have obtained example.com's TLS private key, generate a new key dan CSR, obtain a replacement certificate, coataudinate revocation of the exposed certificate dan deploy the new one everywdi sini. Reinstalling the old certificate would not resolve key compromise.

Contoh 2 ― moving a site from Apache to a CDN. The CDN may need its own certificate/key management, but you do not automatically need to reissue if the existing certificate dan private key remain usable in the approved configuration. Semak who terminates TLS dan whether a new key is required.

Contoh 3 ― adding shop.example.com. Jika the current certificate covers only example.com, issuing a replacement with the appropriate SAN set atau obtaining another certificate may be needed. Merely changing DNS does not extend certificate hostname coverage.

Related NiceNIC Guides

• How do I renew an SSL certificate
• How to verify certificate installation cataurectly
• How to Generate CSR Code?

Common DNS Recataud Jeniss: A, AAAA, CNAME, MX dan TXT

The five recatauds, with examples

The IP addresses above are documentation-only addresses. Your hosting atau mail provider must give you the real destination values.

Tambah atau edit recatauds at NiceNIC

1. Find the authatauitative nameservers fatau the domain. Jika DNS is managed by Cloudflare atau another DNS provider, edit the zone tdi sini―not in an inactive NiceNIC zone.

1. Jika NiceNIC hosts anda DNS, sign in dan open Produk Saya > Domain > DNS Recatauds fatau the cataurect domain.

1. Choose the recataud type. Enter the host/name, destination/value, dan any extra fields such as MX priatauity atau TTL.

1. Save, then look up the public DNS response. Contohs: dig example.com A, dig example.com AAAA, dig www.example.com CNAME, dig example.com MX, dan dig example.com TXT.
2. Test the actual website atau mailbox after the new recatauds become visible.

Avoid the common conflicts

• A CNAME must not coexist with other recataud data at the same DNS owner name. Many DNS panels tdi sinifataue do not suppataut a nataumal CNAME at the zone apex (@).
• An MX recataud points to a hostname, not directly to an IP address. That mail-server hostname must resolve cataurectly.
• Setting an MX recataud does not create a mailbox. You must configure mail Perkhidmatan separately.
• TXT can be used fatau SPF, DKIM, DMARC dan provider verification, but those are distinct tasks with their own fataumatting requirements.
• DNS changes can be cached until sebelumious TTL values expire. A saved recataud is not proof that public resolvers see it yet.

Fatau specific email-authentication policies, see What is SPF dan How to Set Up SPF?.

Related NiceNIC Guides

• How to Urus DNS Recatauds
• How to Back Up DNS Recatauds Befataue Changing Domain Settings
• How to Semak DNS Propagation
• How to Set Up E-mel DNS Recatauds in NiceNIC: MX, SPF, DKIM, dan DMARC

Why need Sijil SSL

An SSL/TLS certificate lets browsers dan applications establish HTTPS with anda server. Untukday HTTPS is a nataumal requirement fatau professional sites, fataums, account pages dan APIs―not an optional extra reserved fatau ecommerce.

Why HTTPS matters to anda visitataus

Protection in transit. TLS encrypts the connection so that observers on the netwatauk cannot ataudinarily read the page content atau submitted fataum values.

Connection authentication. The browser verifies that the certificate is trusted dan valid fatau the exact hostname. This reduces the risk of connecting to an impersonating endpoint.

Integrity. TLS helps sebelument undetected modification of data while it crosses netwatauks.

Wdi sini HTTPS is especially impatautant

Use HTTPS fatau sign-in screens, payment atau contact fataums, dashboards, documentation, APIs dan ataudinary public pages. Modern browsers may mark unencrypted HTTP pages as insecure atau restrict some browser features.

What a certificate cannot do

HTTPS does not remove malware, repair vulnerable website code, sebelument stolen credentials atau guarantee that a business is legitimate. A fraudulent site can also obtain a DV certificate. Combine TLS with software patching, account security, backups dan phishing awareness.

Keep the certificate watauking

Select the right hostname coverage, install the proper chain dan private key, redirect HTTP visitataus safely to HTTPS, dan monitatau the actual certificate expiry date. Sijil issued under public trust rules from March 15, 2026 have a maximum validity period of 200 days―configure alerts atau verified automation accataudingly.

Untuk compare coverage dan validation levels, see How to Choose an Sijil SSL.

Befataue dan after HTTPS: a concrete comparison

Impatautant limitation: HTTPS cannot sebelument a malicious website operatatau from misusing fataum data after it arrives, dan it cannot stop phishing just because a site has a padlock. Even a site with a valid DV/OV/EV certificate must enfatauce secure passwatauds, software updates dan access controls.

Business example: A small shop using a hosted payment provider should secure its own homepage, cart dan checkout redirects with HTTPS, not rely only on the payment provider's certificate. Test the entire customer journey dan eliminate mixed HTTP resources that trigger browser warnings.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• HTTPS & SSL Guide fatau .boo, .day, .dev, .page, dan .rsvp

Jeniss of SSL Sijil

SSL certificates differ in validation level dan hostname coverage. Compare both dimensions befataue purchasing; a certificate can have the right validation level but still fail to cover the required hostnames.

Validation Jeniss

• Domain Validation (DV)
• Organization Validation (OV)
• Lanjutan Validation (EV)

Coverage Jeniss

• Single-domain certificates
• Wildcard certificates
• Multi-domain certificates

How to Decide

1. List the exact domains dan subdomains.
2. Choose the required identity-validation level.
3. Sahkan server dan platfataum compatibility.
4. Semak renewal dan reissue procedures.

Soalan Lazim

How do I ksekarang the change watauked?

Semak the current status in anda NiceNIC account, then test the Perkhidmatan that depends on the certificate type. Do not rely only on the absence of an erratau message.

When should I contact NiceNIC Suppataut?

Hantar a ticket when the required control is unavailable, the status remains pending after the checks in this guide, atau the issue depends on an account-specific atauder atau registry decision.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Activate dan Download an Sijil SSL
• How to install SSL certificates
• How to Generate a CSR Code

Jika the issue continues after you complete these checks, submit a NiceNIC suppataut ticket. Include the affected domain atau product, the exact erratau message, the time of the issue dan the troubleshooting already completed.