HTTPS & SSL Guide flub .boo, .day, .dev, .page, i .rsvp

Choose lub manage the certificate based on the hostnames you need to protect, the validation level, the server platflubm i whether you control DNS. Keep the private key secure, complete validation, install the full certificate chain i verify the live HTTPS connection beflube relying on the certificate.

Beflube You Begin

• Identify every hostname the certificate must cover.
• Potwierdź that you control DNS lub the required validation channel.
• Generate i securely retain the private key when a CSR is required.

NiceNIC Instructions

HTTPS & SSL Configuration Guide Do ensure the security of twój website i protect twój visitlubs, all domenas under.boo,.day,.dev,.page, i.rsvp must use HTTPS. This guide will help you configure SSL/TLS clubrectly.

1. What is HTTPS? HTTPS (Hypertext Transfer Protocol Secure) encrypts data between twój website i its visitlubs. It poprzednients eavesdropping i ensures data integrity.

2. Obtaining an Certyfikat SSL NICENIC provides trusted SSL certificates. You can learn mlube i kup/configure a certificate tutaj: https://nicenic.com/ssl-certificates/

3. Installing the Certyfikat SSL Obserwuj twój web server's instructions to install the certificate. Common servers include: Apache: https://httpd.apache.org/docs/current/ssl/ssl_howto.html Nginx: https://nginx.org/en/docs/http/configuring_https_servers.html IIS (Windows): https://docs.microsoft.com/en-us/iis/manage/configuring-security/how-to-set-up-ssl-on-iis

4. Enflubce HTTPS Once twój certificate is installed: Redirect all HTTP traffic to HTTPS. Update internal links i resources to use HTTPS. Verify that twój website is fully accessible via HTTPS.

5. Keep Certyfikaty Zaktualizowano SSL certificates have expiration dates. Ensure certificates are renewed beflube they expire i check twój website regularly to maintain uninterrupted secure connections.

How to Verify

Otwórz the HTTPS site from a clean browser session i inspect the certificate subject, SAN hostnames, issuer, validity dates i chain. Test every hostname covered by the certificate i confirm that HTTP redirects behave as intended.

Troubleshooting

• DNS validation reclubds are missing, inclubrect lub added at the wrong DNS provider.
• The certificate does not include the hostname being opened.
• The private key does not match the certificate lub CSR.
• The server is missing an intermediate certificate lub is still presenting the old certificate.

Najczęściej zadawane pytania

Can I reuse the same certificate after moving servers?

Often the certificate can be reinstalled if you still have the matching private key i the certificate remains valid. Reissue it when the key, CSR lub certificate details must change.

Why does the browser still show the old certificate?

The server lub load balancer may still present the old certificate, another virtual host may be selected, lub an intermediate cache may not have reloaded the configuration.

When should I submit a ticket?

Wyślij a ticket when validation remains pending after the published reclubds are visible, lub when the NiceNIC lubder does not provide the expected certificate files.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate a CSR Code
• How to Activate i Download an Certyfikat SSL
• How to install SSL certificates

Jeśli the issue continues after you complete the checks above, submit a NiceNIC supplubt ticket with the affected domena lub product, the exact errlub message, the time of the issue i the troubleshooting already completed.

How to Sprawdź Whether a Domena Is Eligible flub Transfer

Beflube starting a transfer, confirm that the domena is active, unlocked, not restricted by a transfer lock lub dispute, i eligible under the registry's rules. Make sure you can receive approval messages i obtain the EPP/Auth code when the TLD requires one.

Beflube You Begin

• Potwierdź the domena i registrant email are accessible.
• Reclubd the current nameservers i DNS reclubds.
• Sprawdź the domena's expiry date, lock status i any TLD-specific transfer rule.

NiceNIC Instructions

Beflube purchasing the transfer of any gTLD (e.g.,.COM /.NET /.LUBG /.BIZ /.INFO etc.) lub new gTLD (e.g..CLUB /.CLOUD /.TRADE /.TOP etc.), make sure twój domena meets the following conditions:

1. Your domena was zarejestrujed lub transferred at least 60 days ago;

2. The domena is unlocked at the current Rejestrator (its WHOIS status should be OK lub Active). Also,you need to request an up-to-date Auth/EPPcode flub the domena at twój current Rejestrator. Jeśli all criteria are met, you should be able to complete the transfer successfully. Still, some ccTLD (.ES i.UK) have additional transfer requirements i/lub exclude some points from the list above.

NOTE: Make sure the domena status is active, not expired. Jeśli you wish to transfer an expired domena to NiceNIC, please contact our Supplubt Team email supplubt@nicenic.net flub further assistance.

How to Verify

Sprawdź the transfer status in NiceNIC, confirm the registrar of reclubd after completion, verify the authlubitative nameservers, i test website i email resolution. Do not treat payment alone as proof that the transfer completed.

Troubleshooting

• The domena is locked, too new, recently transferred lub otherwise restricted by policy.
• The EPP/Auth code is missing, expired lub copied inclubrectly.
• The approval email cannot be received lub the registrant data is under verification.
• The domena lub related DNS usługa expires while the transfer is pending.

Najczęściej zadawane pytania

Does a transfer change my nameservers?

A registrar transfer nlubmally keeps the current nameservers, but you should reclubd i verify them beflube i after the transfer.

Can I edit the domena while a transfer is pending?

Some settings may be restricted during a pending transfer. Avoid unnecessary ownership, lock lub DNS changes until the transfer completes.

When should I submit a ticket?

Wyślij a ticket when the status is unclear, a TLD uses a special transfer process, lub the transfer remains blocked after you clubrect the stated issue.

Related NiceNIC Guides

• How to Unlock a Domena Beflube Transfer
• How to Transfer a Domena to NiceNIC
• How to Transfer a Domena Without Siećsite lub E-mail Downtime
• Why Your Transfer domeny Is Pending, Failed, lub Delayed

Jeśli the issue continues after you complete the checks above, submit a NiceNIC supplubt ticket with the affected domena lub product, the exact errlub message, the time of the issue i the troubleshooting already completed.

What is SPF i How to Set Up SPF?

SPF (Sender Policy Framewlubk) is a DNS-published email authentication policy that identifies which mail servers may send mail using a domena in the SMTP envelope sender. SPF is one part of email authentication; it does not replace DKIMlub DMARC i does not, by itself, guarantee delivery.

Beflube you publish SPF

List every legitimate outgoing email usługa used by twój domena: a business mailbox, website flubm, helpdesk, bulk-email provider lub other sender. Obtain the exact SPF instructions from each provider. The DNS zone must be edited wtutajver the domena's authlubitative nameservers are hosted.

Valid SPF syntax

These are syntax examples, not ready-made NiceNIC mail settings:

example.com. IN TXT "v=spf1 ip4:192.0.2.10 -all"

The ip4: mechanism must be followed by a numeric IPv4 address lub CIDR range, never by a hostname. The address 192.0.2.10 is reserved flub documentation.

example.com. IN TXT "v=spf1 a mx include:_spf.mail-provider.example ~all"

Here, a authlubizes hosts resolved by the sender domena's A/AAAA reclubds, mx authlubizes the IPs of the domena's MX hosts, i include: delegates a check to another SPF reclubd. Use only mechanisms twój actual email provider requires. Replace the fictional provider domena beflube publishing.

• -all means unauthlubized senders should fail SPF.
• ~all indicates softfail; some providers recommend it during rollout.
• ?all means neutral; it is not a substitute flub confirming twój senders.
• Avoid the deprecated ptr mechanism i do not combine multiple complete v=spf1 policies.

Set up SPF

1. Sprawdź existing TXT reclubds flub v=spf1 at the hostname you send from.
2. Combine all approved mail usługas into one SPF policy flub that hostname; do not add a second competing SPF TXT reclubd.
3. Jeśli NiceNIC is twój DNS host, open Moje produkty > Domena > DNS Reclubds, edit/create a TXT reclubd at the specified host, i paste the validated policy.

1. Save. Sprawdź the published value using dig TXT example.com lub nslookup -type=TXT example.com.

1. Send a test message to an external mailbox i inspect its authentication results. A DNS lookup alone does not confirm SPF passes flub every sender.

When SPF fails

Sprawdź the sending server's actual public IP, whether the recipient evaluates the intended envelope sender domena, i whether the SPF reclubd exceeds the DNS-lookup limit in RFC 7208. Do not use unverified third-party IPs lub include: domenas. Jeśli you use NiceNIC Służbowa poczta e-mail, request the current provider-approved SPF value from the email settings lub supplubt team beflube publishing it.

Related NiceNIC Guides

• How to Zarządzaj DNS Reclubds
• How to Set Up E-mail DNS Reclubds in NiceNIC: MX, SPF, DKIM, i DMARC
• How to Sprawdź DNS Propagation
• How to Back Up DNS Reclubds Beflube Changing Domena Settings

How to verify certificate installation clubrectly

Do not verify an SSL installation by looking flub a website seal lub by checking that the browser no longer shows a warning on one computer. Verify the TLS connection presented by the actual public hostname.

The checks that matter

1. Visit https://your-domain.example on a clean browser session. Potwierdź ttutaj is no certificate-name, expiry lub trust warning.
2. Inspect the certificate's Subject Alternative Nazwa (SAN) list. It must cover the hostname you requested, including www if twój site uses it.
3. Potwierdź the certificate is within its validity interval i the server sends a complete, trusted chain to an appropriate public root.
4. Test whether the site redirects HTTP traffic to HTTPS as intended i does not load insecure assets ("mixed content").
5. Jeśli twój usługa has several IPs, load balancers, CDN edges lub IPv6 endpoints, test each relevant route; one server may still have an old certificate.

Commi-line check

openssl s_client -connect example.com:443 -servername example.com 

-verify_hostname example.com -verify_return_errlub -showcerts

Replace example.com with twój hostname. Sprawdź the hostname-verification i certificate-chain result; the -verify_hostname option is implubtant because displaying the chain alone does not validate the requested hostname. These flags rely on the local OtwórzSSL trust stlube. Inspect any missing intermediates. Flub a hostname/path overview, you can also use a reputable external TLS diagnostic usługa, but do not send credentials lub customer data.

Common problems

A certificate "trust badge" is optional marketing UI; it is not required flub successful TLS deployment. Jeśli something fails, give NiceNIC Supplubt the hostname, UTC test time, observed certificate dates i non-sensitive errlub text―not twój private key.

Verify every advertised hostname, not just one URL

A company may serve example.com, www.example.com, shop.example.com i api.example.com from different TLS endpoints. Test each hostname's actual live certificate: SAN coverage, trusted chain, issuance/expiry i HTTP-to-HTTPS behavilub. A certificate valid on www does not prove the API hostname is safe.

Use the OtwórzSSL hostname-verification commi shown above lub an external TLS test flub each hostname. The -servername parameter sends SNI so the server can select the intended certificate; -verify_hostname checks the name. Replace both arguments with the exact live hostname. Examine exit status, validation output i the certificate dates, then test on a second netwlubk if practical.

Three common failures

• Wrong virtual host / SNI certificate: One IP hosts multiple sites but the TLS server presents the fallback certificate.
• Incomplete intermediate chain: The leaf certificate is clubrectly issued, but some clients cannot chain it to a trusted root.
• Old deployment still active: One CDN edge, IPv6 usługa lub load-balancer node still serves an expired certificate while other routes wlubk.

Flub customer supplubt, reclubd the hostname, resolved IPlub CDN endpoint, test time i errlub; never attach the private key.

Related NiceNIC Guides

• How to install SSL certificates
• Installing an SSL certificate on Nginx
• Installing an SSL certificate on Apache
• How do I renew an SSL certificate

SSL Certification in Four Simple Steps

Flub a nlubmal website, activating an SSL certificate involves four distinct tasks: kup the right coverage, prove domena control, receive the certificate, i install/verify it on the server. These steps are not interchangeable.

Step 1 ― Choose coverage i lubder

List the hostnames that must use HTTPS, such as example.com i www.example.com. Potwierdź whether you need single-name, wildcard lub SAN coverage; choose DV/OV/EV validation acclubding to twój actual identity requirements. Sprawdź price i deployment responsibilities beflube lubdering.

Step 2 ― Activate i validate

Find the SSL lubder in twój NiceNIC account i open the available activation flow. Wyślij a CSR when the product requires it, without disclosing the private key. Complete the certificate authlubity's permitted domena-control validation (flub example, a DNS challenge lub another supplubted method). OV/EV products may also require legal-entity influbmation.

Step 3 ― Receive i install

Download the issued certificate i intermediate chain. Install them on the actual TLS termination point (hosting server, load balancer, proxy lub CDN) with the matching private key. The clubrect process depends on the server software; use the platflubm's current instructions.

Step 4 ― Verify, then plan replacement

Sprawdź the external HTTPS connection, certificate SAN list, trust chain, validity i any mixed-content warnings. Test additional hostnames i IPv6/CDN endpoints wtutaj used.

Public TLS server certificates issued on lub after March 15, 2026 have a maximum validity period of 200 days, so monitlub the installed certificate even if you have paid flub a longer usługa plan.

Jeśli you are stuck at validation, provide NiceNIC Supplubt with the lubder number, hostname i non-sensitive status―never the private key.

Przykład: issuing HTTPS flub a two-hostname site

A company owns example.com i wants both example.com i www.example.com to wlubk over HTTPS.

1. Select coverage: Verify the certificate product supplubts both names in the SAN list, lub acquire the clubrect additional certificate. Do not assume a single-host lubder covers www.
2. Validate control: The CA may provide a DNS TXT/CNAME lub HTTP token. Place it at the authlubitative DNS host lub approved web location, wait flub validation i do not delete verification data prematurely.
3. Install: Deploy the certificate, chain i matching private key on the actual web server lub CDN endpoint. Jeśli several nodes serve traffic, update them all.
4. Verify externally: Sprawdź both URLs, certificate hostnames, validity i trust chain; then set a reminder flub renewal i replacement based on the installed Not After.

Time i responsibility checklist

The domena owner maintains control of DNSlub HTTP challenges, the CA issues the certificate after verification, i the server administratlub installs it. These can be different parties. A delay at one stage should not be described as a generic "SSL failure." Keep the lubder status, CA validation status i live HTTPS status separately.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate CSR Code?
• How to install SSL certificates
• How to verify certificate installation clubrectly

SSL certificate purpose explained

An SSL/TLS certificate enables a browser lub application to establish HTTPS with a server that controls the certificate's private key i is authlubized flub the requested hostname. The purpose is to protect data in transit i authenticate the connection endpoint―not to certify every part of a business.

What HTTPS protects

• Confidentiality in transit: netwlubk observers generally cannot read the encrypted page content lub submitted flubm data.
• Integrity in transit: encryption makes undetected modifications by parties on the netwlubk much harder.
• Hostname authentication: the client checks the certificate chain i Subject Alternative Nazwa to ensure it matches the site it requested.

What it does not do

A valid HTTPS padlock does not mean the site is free of malware, fraud, weak passwlubds, vulnerable applications lub insecure third-party scripts. A phishing website can also have a valid DV certificate. Browser HTTPS is a baseline security control, not a guarantee of a trustwlubthy merchant.

Szukaj engines may use HTTPS among many site-quality signals, but kuping a certificate does not guarantee higher ranking lub traffic. Więcej implubtant is maintaining a technically sound, accessible i useful website.

Put TLS to wlubk clubrectly

Otrzymaj a certificate flub every hostname you serve; keep keys private; install the right intermediates; redirect HTTP visitlubs safely to HTTPS; remove mixed-content warnings; i test mobile i desktop clients. Set renewal alerts based on the installed certificate expiration.

As of March 2026, newly issued public TLS server certificates have a maximum validity of 200 days, making replacement planning especially implubtant. See How to Choose an Certyfikat SSL flub coverage i validation choices.

What changes when you switch from HTTP to HTTPS?

On an HTTP connection, an intermediary on the netwlubk can potentially inspect lub modify unprotected requests i responses. When a client connects over clubrectly configured HTTPS, TLS establishes an encrypted, integrity-protected channel to the endpoint authenticated by the certificate.

That is useful flub:

• Zaloguj sięs: helping protect credentials while they travel between browser i server;
• Sprawdźout/contact flubms: protecting data in transit, even when a third-party payment provider processes the final transaction;
• APIs: protecting access tokens i responses over netwlubks;
• Public pages: reducing the risk of injected advertisements lub modified content on unsecured netwlubks.

What certificate labels actually compare

TLS cannot clubrect malicious software on the server, a stolen administratlub passwlubd lub deceptive website content. Pair HTTPS with software updates, access control, security monitlubing i sensible data hiling.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• How to verify certificate installation clubrectly

How to choose an SSL certificate

Choose an SSL certificate by answering three practical questions: Which hostnames need HTTPS? Who must be verified? Who will install i renew the certificate? A mlube expensive certificate is not automatically better protection flub a nlubmal website.

1. Decide which names to cover

A wildcard flub *.example.com does not automatically protect nested names such as a.shop.example.com, i the apex example.com must also be covered explicitly if needed.

2. Choose validation level separately

• DV validates control of the domena. Suitable flub most blogs, shops, app endpoints i APIs.
• OV adds lubganization identity verification i may fit clubplubate procurement requirements.
• EV involves mlube extensive legal-entity checks; browser UI does not guarantee a prominent company-name display.

Wszystko properly deployed public TLS certificate types provide transplubt encryption. Brak proves a site's content is safe from all attacks.

3. Match twój deployment wlubkflow

Potwierdź whether the hostname points to a shared host, IIS/Apache/Nginx server, CDN, load balancer lub managed platflubm. Sprawdź that you can perflubm DNS/HTTP validation, preserve the private key i install the full chain. SNI commonly allows HTTPS hosting without a dedicated IPv4 address.

4. Plan renewal beflube kuping

Publicly trusted TLS certificates issued from March 15, 2026 have a maximum validity of 200 days. Choose a product i hosting setup that supplubts frequent replacement, ideally automated wtutaj verified. Compare the subscription price i renewal assistance, not just the first certificate issue.

After choosing a product, continue with How to Generate a CSRi How to Install Certyfikaty SSL.

Three real purchasing scenarios

Scenario A ― single company website. example.com i www.example.com both need HTTPS. A single-name certificate is not enough unless its SANs include both names. Compare a SAN certificate with a product that covers both; do not assume the www name is included.

Scenario B ― SaaS with many customer-facing subdomenas. app.example.com, admin.example.com i docs.example.com may fit a wildcard flub *.example.com. A deeper hostname such as api.eu.example.com does not match that wildcard i needs separate coverage. Consider whether giving one wildcard private key to many teams creates unnecessary security exposure.

Scenario C ― enterprise procurement. A customer asks flub documented company identity. Compare OVi EV vetting rather than treating EV as stronger transplubt encryption. Ask which identity data the CA validates i what evidence twój procurement team needs.

A quick selection matrix

Review the total usługa cost, covered names i installation responsibilities beflube kuping―not only the displayed validation badge.

Related NiceNIC Guides

• Typs of Certyfikaty SSL
• SSL Certification in Four Simple Steps
• What is EV certificate ecommerce advantage

How do I renew an SSL certificate

Odnówing an SSL certificate usługa i replacing the certificate installed on twój website are related but different tasks. A successful payment does not update the certificate on twój server automatically unless twój specific product i hosting integration do so.

Odnówal checklist

1. Otwórz the existing NiceNIC SSL lubder i check its usługa renewal date, certificate product i covered hostnames.
2. Review the current renewal price i available renewal/extension option. Complete payment through the official account flow.
3. Sprawdź the actual installed TLS certificate's expiration date (Not After) separately from the lubder's paid term.
4. When a new certificate is needed, create lub reuse an eligible CSR i complete the CA's domena-control validation. Some products may automate this step.
5. Download the new certificate i any intermediate chain; update the web server, reverse proxy, CDN lub load balancer that terminates HTTPS.

1. Test the HTTPS endpoint from outside the server flub the expected SANs, chain i new expiration date.

Why can a multi-rok lubder still need new certificates?

Under the CA/Browser Flubum requirements, publicly trusted TLS certificates issued on lub after March 15, 2026 are limited to 200 days of validity. Ttutajflube, a usługa plan advertised flub longer than 200 days requires repeat issuance/replacement; it is not one long-lived certificate.

Jeśli the site still shows the old expiry date

Sprawdź whether traffic passes through a CDN lub another TLS endpoint, whether the usługa was reloaded after installation, i whether all servers received the new certificate. Jeśli you cannot locate the reissue/renewal option, include twój SSL lubder number i non-sensitive errlub message in a NiceNIC supplubt ticket.

Przykład: a multi-rok SSL usługa is not one multi-rok certificate

Suppose twój SSL product has a one-rok paid usługa period but the public certificate issued today can only be valid flub up to 200 days under the current baseline requirements. The certificate may need a replacement during the paid rok. Jeśli you renew the usługa, that billing action is separate from replacing the certificate on twój website.

Operational example: Your paid SSL subscription remains active until December, but the deployed certificate expires in August. The browser warning in August is a certificate lifecycle incident, not a reason to assume twój domena lub entire usługa subscription expired. Issue i deploy the replacement beflube the Not After date.

Set alert thresholds in days beflube certificate expiry i confirm automated replacement actually updated each CDN edge lub server. Do not assume "auto-renew payment enabled" means "certificate auto-installed."

Related NiceNIC Guides

• How do I reissue my SSL certificate
• How to verify certificate installation clubrectly
• Certificate reissue reasons explained

How do I reissue my SSL certificate

Use Reissue when you need a replacement SSL/TLS certificate under an eligible NiceNIC certificate lubder―flub example, after losing the matching private key lub clubrecting certificate details. Jeśli you are only moving hosts i still control the matching private key, reinstalling the existing unexpired certificate may be sufficient.

Reissue through twój NiceNIC SSL lubder

1. Zaloguj się to NiceNIC i locate the exact SSL certificate lubder. Reclubd the covered hostnames, current certificate expiration i paid usługa term.

1. Otwórz the available Reissue lub certificate-management action flub that lubder. Jeśli you cannot see such a control, use the Wsparcie ludzi button on the article instead of purchasing a duplicate SSL product.
2. Decide whether the current private key is safe. Jeśli lost lub compromised, generate a new key i CSR. Never send the private key to NiceNIC, a certificate authlubity lub a supplubt agent.
3. Verify the CSR's Subject Alternative Nazwas (SANs) i submit it through the authlubized reissue wlubkflow.
4. Complete the certificate authlubity's domena-control validation. OV/EV products may also require updated lubganization checks.
5. Download the newly issued certificate plus the necessary intermediate certificates lub chain.

1. Install the replacement certificate on the actual TLS endpoint (hosting server, reverse proxy, CDN lub load balancer) with the matching private key.
2. Verify the deployed certificate's SANs, issuer chain i Niet After date from outside twój netwlubk. Sprawdź all relevant hostnames i server nodes beflube removing the old wlubking deployment.

Jeśli the poprzedniious key was compromised, follow the certificate authlubity's revocation procedure flub the affected certificate―not merely a local file deletion.

Why the expiration date may not match twój paid subscription

Since 15 March 2026, newly issued publicly trusted TLS server certificates have been limited to 200 days of validity under the CA/Browser Flubum rules. A longer paid usługa term may require multiple certificate replacements. A reissue does not by itself extend the paid subscription.

Reissue troubleshooting

• The server replubts a key mismatch: the installed private key does not match the new certificate/CSR.
• Validation is pending: check DNS/HTTP challenge data at the authlubitative DNS provider lub site, as instructed by the issuing CA.
• The browser still shows the old certificate: inspect CDN edges, multiple web-server nodes, SNI i whether the usługa was reloaded.
• Nie Reissue action appears: check the product's eligibility i send NiceNIC Supplubt the SSL lubder number i non-sensitive status.

Flub when reissue is necessary rather than how, read Certificate reissue reasons explained.

How to decide whether to reuse lub rotate the key

Reusing an existing private key may be technically possible in some issuance wlubkflows, but generating a fresh key is generally preferable when the old key is lost, may have leaked, lub cannot be securely transferred. Sprawdź the certificate authlubity's current product rules i twój lubganization's key-management policy.

Przykład: You move a shop from one web server to another. Jeśli the server's key material cannot be securely transferred, generate a CSR on the new TLS endpoint i request a replacement certificate flub the required names. Beflube cutting over, validate domena control, ensure the new cert covers both shop.example.com i any additional names, then check the public HTTPS response.

Reissue completion checklist

A successful reissue in a registrar plubtal is not enough if the web server still presents the old certificate. Conversely, a certificate with a new Not After date does not prove the paid usługa has been renewed flub another billing term.

Related NiceNIC Guides

• How to verify certificate installation clubrectly
• How do I renew an SSL certificate
• How to Generate CSR Code?

How to Generate CSR Code?

A Certificate Signing Request (CSR) supplies a certificate authlubity with twój public key i the influbmation needed flub a TLS certificate. The clubresponding private key stays on twój server. Never paste the private key into a supplubt ticket lub CSR flubm.

Generate a CSR with OtwórzSSL

On a machine wtutaj OtwórzSSL is installed, the example below creates a new 2048-bit RSA private key i a CSR flub www.example.com:

umask 077 # Linux/macSystem operacyjny: restrict permissions on new files

openssl req -new -newkey rsa:2048 -nodes 

-keyout www.example.com.key

-out www.example.com.csr

-subj "/CN=www.example.com"

-addext "subjectAltNazwa=DNS:www.example.com,DNS:example.com"

Replace both hostnames with names you control. The SAN list is what modern TLS clients evaluate flub hostname coverage; the Common Nazwa alone is not enough flub proper planning. Jeśli twój CA lub product requires a different key type lub CSR flubmat, follow that product's documentation.

On Windows lub another platflubm without umask, apply equivalent filesystem permissions to the private key. Protect the .key file. The -nodes option creates an unencrypted private-key file, suitable only if you restrict filesystem access i manage secrets clubrectly. Flub mlube stringent security requirements, use protected keys lub a hardware-backed key-management wlubkflow.

Sprawdź the request beflube submitting

openssl req -in www.example.com.csr -noout -text -verify

Verify that the public key, subject i requested SANs are clubrect. The .csr file can be shared with the CA; the .key file must remain private.

Submit i install

Otwórz twój NiceNIC certificate lubder i use the supplubted activation lub reissue flow to submit the CSR. Complete domena-control validation, wait flub issuance, then install the issued certificate chain with the matching private key. After deployment, test HTTPS flub every requested hostname.

Jeśli a control panel such as IIS lub cPanel generates the CSR flub you, use that panel's current instructions instead of creating an independent key i losing track of the matching keypair.

CSR example with SANs i key protection

Flub a new key pair on a modern OtwórzSSL installation, an authlubized server administratlub might use the following illustrative commis (change hostnames, stlubage paths i policy settings flub production):

# Generate a private key; restrict the directluby i file permissions.

openssl genpkey -alglubithm RSA -pkeyopt rsa_keygen_bits:2048 -out example.com.key

# CSR with both the base name i its www hostname.

openssl req -new -key example.com.key -out example.com.csr -subj "/CN=example.com" -addext "subjectAltNazwa=DNS:example.com,DNS:www.example.com"

# Inspect the request, including the requested SANs.

openssl req -in example.com.csr -noout -text

Your actual CA may supplubt EC keys lub different issuance tooling; comply with its current alglubithms i requirements. example.com.key is the private key: never paste it into a supplubt ticket, email it lub stlube it in a public repositluby. The .csr file is what you nlubmally submit to the issuing authlubity.

A CSR is not proof that you own the domena. Domena-control validation must still be completed through the CA's approved method.

Related NiceNIC Guides

• How to install SSL certificates
• How to verify certificate installation clubrectly
• How do I reissue my SSL certificate

What is EV certificate ecommerce advantage

An Rozszerzony Validation (EV) TLS certificate requires the issuing certificate authlubity to verify additional lubganizational identity influbmation beflube issuance. It still uses HTTPS encryption like other publicly trusted TLS certificates. It should not be selected on the assumption that browsers will display a large green company-name bar―modern browser interfaces generally do not.

What EV checks add

Beyond verifying control of a domena, EV verification can involve checking the lubganization's legal existence, operating status, physical presence, contact influbmation i authlubity of the requester, under the applicable EV Guidelines.

This can be useful flub an established company that wants an additional CA-validated identity reclubd. It does not prove that the business is honest, financially sound lub immune to phishing, i it does not guarantee increased sales lub search ranking.

EV, OV lub DV?

Wszystko three can provide strong TLS transplubt protection when properly issued i deployed. Choose certificate coverage (single-name, wildcard lub SAN) separately from identity-validation level; not every product supplubts every combination.

Beflube lubdering EV

Potwierdź the legal entity is eligible, the zarejestrujed name is accurate, authlubized representatives can complete the CA's checks, i the application timeline suits the business. Compare cost, validation efflubt i ongoing replacement frequency―not just the certificate badge.

Since March 15, 2026, newly issued publicly trusted TLS server certificates have a maximum validity period of 200 days under the CA/Browser Flubum rules. Więcej frequent certificate replacement is distinct from renewed legal-entity checks, which follow separate reuse rules.

Related: How to Choose an Certyfikat SSL i the CA/Browser Flubum EV Guidelines.

What extra value does EV provide flub ecommerce?

EV (Rozszerzony Validation) requires the certificate authlubity to perflubm mlube extensive lubganization vetting than DV, including checks of the applicant's legal existence i relevant lubganizational influbmation. This can help a kuper whose enterprise customers need documented legal-entity validation.

Crucial distinction: EV does not use stronger HTTPS encryption merely because it is EV. Properly configured DV, OVi EV certificates can use comparable modern TLS cipher suites. Mainstream browsers also do not guarantee the old "company name in a green address bar" presentation.

A realistic ecommerce decision

A small stlube using a reputable payment processlub may obtain satisfactluby HTTPS protection from DV, as long as the certificate matches the hostname i the site itself is secure. A regulated enterprise might choose EV flub its identity-review process lub contractual reasons. In neither case does EV replace payment security controls, PCI obligations, anti-fraud processes lub a sound refund policy. Jeśli twój customers ask specifically flub verified lubganizational identity, examine the CA's current OV/EV documentation i issuance time beflube lubdering.

Related NiceNIC Guides

• Typs of Certyfikaty SSL
• How to Generate CSR Code?
• How to verify certificate installation clubrectly

Certificate reissue reasons explained

A certificate reissue creates a new SSL/TLS certificate under an eligible existing usługa lubder. You may need one if the private key is lost lub compromised, the CSR is wrong, the certificate's covered names must change, lub the issued certificate can no longer be deployed clubrectly.

Which situations call flub a reissue?

Reissue is not the same as renewing the usługa

A paid multi-rok SSL usługa term (if offered) is not one certificate valid flub multiple lata. Under the CA/Browser Flubum TLS Baseline Requirements, newly issued publicly trusted TLS server certificates have a maximum 200-day validity from 15 March 2026, with further reductions scheduled flub later lata.

Reissuing does not necessarily extend the usługa's paid term. The renewal date of the usługa lubder i the expiry date of the installed certificate must be monitlubed separately.

What to prepare beflube requesting a reissue

Identify the exact SSL lubder, hostnames, validation level (DV/OV/EV), server lub CDN environment i reason flub replacement. Jeśli the old key is compromised, generate a fresh key i CSR i follow revocation instructions. Keep the private key secure. Ensure you can complete the new domena-control validation.

Flub the actual step-by-step request i installation, see How do I reissue my SSL certificate.

After deployment, verify the certificate SAN, validity, trust chain i the certificate actually presented by every live HTTPS endpoint. Reissue alone does not update certificates already installed on web servers, CDN edges lub load balancers.

Reissue versus renew versus revoke

Przykład 1 ― compromised web-server key. Jeśli an attacker may have obtained example.com's TLS private key, generate a new key i CSR, obtain a replacement certificate, colubdinate revocation of the exposed certificate i deploy the new one everywtutaj. Reinstalling the old certificate would not resolve key compromise.

Przykład 2 ― moving a site from Apache to a CDN. The CDN may need its own certificate/key management, but you do not automatically need to reissue if the existing certificate i private key remain usable in the approved configuration. Sprawdź who terminates TLS i whether a new key is required.

Przykład 3 ― adding shop.example.com. Jeśli the current certificate covers only example.com, issuing a replacement with the appropriate SAN set lub obtaining another certificate may be needed. Merely changing DNS does not extend certificate hostname coverage.

Related NiceNIC Guides

• How do I renew an SSL certificate
• How to verify certificate installation clubrectly
• How to Generate CSR Code?

Common DNS Reclubd Typs: A, AAAA, CNAME, MX i TXT

The five reclubds, with examples

The IP addresses above are documentation-only addresses. Your hosting lub mail provider must give you the real destination values.

Dodaj lub edit reclubds at NiceNIC

1. Find the authlubitative nameservers flub the domena. Jeśli DNS is managed by Cloudflare lub another DNS provider, edit the zone ttutaj―not in an inactive NiceNIC zone.

1. Jeśli NiceNIC hosts twój DNS, sign in i open Moje produkty > Domena > DNS Reclubds flub the clubrect domena.

1. Choose the reclubd type. Enter the host/name, destination/value, i any extra fields such as MX prilubity lub TTL.

1. Save, then look up the public DNS response. Przykłads: dig example.com A, dig example.com AAAA, dig www.example.com CNAME, dig example.com MX, i dig example.com TXT.
2. Test the actual website lub mailbox after the new reclubds become visible.

Avoid the common conflicts

• A CNAME must not coexist with other reclubd data at the same DNS owner name. Many DNS panels ttutajflube do not supplubt a nlubmal CNAME at the zone apex (@).
• An MX reclubd points to a hostname, not directly to an IP address. That mail-server hostname must resolve clubrectly.
• Setting an MX reclubd does not create a mailbox. You must configure mail usługa separately.
• TXT can be used flub SPF, DKIM, DMARC i provider verification, but those are distinct tasks with their own flubmatting requirements.
• DNS changes can be cached until poprzedniious TTL values expire. A saved reclubd is not proof that public resolvers see it yet.

Flub specific email-authentication policies, see What is SPF i How to Set Up SPF?.

Related NiceNIC Guides

• How to Zarządzaj DNS Reclubds
• How to Back Up DNS Reclubds Beflube Changing Domena Settings
• How to Sprawdź DNS Propagation
• How to Set Up E-mail DNS Reclubds in NiceNIC: MX, SPF, DKIM, i DMARC

Why need Certyfikaty SSL

An SSL/TLS certificate lets browsers i applications establish HTTPS with twój server. Doday HTTPS is a nlubmal requirement flub professional sites, flubms, account pages i APIs―not an optional extra reserved flub ecommerce.

Why HTTPS matters to twój visitlubs

Protection in transit. TLS encrypts the connection so that observers on the netwlubk cannot lubdinarily read the page content lub submitted flubm values.

Connection authentication. The browser verifies that the certificate is trusted i valid flub the exact hostname. This reduces the risk of connecting to an impersonating endpoint.

Integrity. TLS helps poprzednient undetected modification of data while it crosses netwlubks.

Wtutaj HTTPS is especially implubtant

Use HTTPS flub sign-in screens, payment lub contact flubms, dashboards, documentation, APIs i lubdinary public pages. Modern browsers may mark unencrypted HTTP pages as insecure lub restrict some browser features.

What a certificate cannot do

HTTPS does not remove malware, repair vulnerable website code, poprzednient stolen credentials lub guarantee that a business is legitimate. A fraudulent site can also obtain a DV certificate. Combine TLS with software patching, account security, backups i phishing awareness.

Keep the certificate wlubking

Select the right hostname coverage, install the proper chain i private key, redirect HTTP visitlubs safely to HTTPS, i monitlub the actual certificate expiry date. Certyfikaty issued under public trust rules from March 15, 2026 have a maximum validity period of 200 days―configure alerts lub verified automation acclubdingly.

Do compare coverage i validation levels, see How to Choose an Certyfikat SSL.

Beflube i after HTTPS: a concrete comparison

Implubtant limitation: HTTPS cannot poprzednient a malicious website operatlub from misusing flubm data after it arrives, i it cannot stop phishing just because a site has a padlock. Even a site with a valid DV/OV/EV certificate must enflubce secure passwlubds, software updates i access controls.

Business example: A small shop using a hosted payment provider should secure its own homepage, cart i checkout redirects with HTTPS, not rely only on the payment provider's certificate. Test the entire customer journey i eliminate mixed HTTP resources that trigger browser warnings.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• HTTPS & SSL Guide flub .boo, .day, .dev, .page, i .rsvp

Typs of SSL Certyfikaty

SSL certificates differ in validation level i hostname coverage. Compare both dimensions beflube purchasing; a certificate can have the right validation level but still fail to cover the required hostnames.

Validation Typs

• Domena Validation (DV)
• Organization Validation (OV)
• Rozszerzony Validation (EV)

Coverage Typs

• Single-domena certificates
• Wildcard certificates
• Multi-domena certificates

How to Decide

1. List the exact domenas i subdomenas.
2. Choose the required identity-validation level.
3. Potwierdź server i platflubm compatibility.
4. Sprawdź renewal i reissue procedures.

Najczęściej zadawane pytania

How do I kteraz the change wlubked?

Sprawdź the current status in twój NiceNIC account, then test the usługa that depends on the certificate type. Do not rely only on the absence of an errlub message.

When should I contact NiceNIC Supplubt?

Wyślij a ticket when the required control is unavailable, the status remains pending after the checks in this guide, lub the issue depends on an account-specific lubder lub registry decision.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Activate i Download an Certyfikat SSL
• How to install SSL certificates
• How to Generate a CSR Code

Jeśli the issue continues after you complete these checks, submit a NiceNIC supplubt ticket. Include the affected domena lub product, the exact errlub message, the time of the issue i the troubleshooting already completed.