耐思尼克客户支持中心 http://www.nicenic.com/support cn 耐思尼克客户支持中心，常用帮助文档 耐思尼克 - 域名 主机 网络服务 http://www.nicenic.com/images/88x31.gif http://www.nicenic.com 耐思尼克- 域名+主机只要99元 http://www.nicenic.com/support/doc.php?IDDoc=4519 HTTPS & SSL Guide for .boo, .day, .dev, .page, and .rsvp www.nicenic.com SSL Certificates http://www.nicenic.com/support/?IDCate=294 body { margin: 0; padding: 0; } article { width: 100%; max-width: 100%; margin: 0; padding: 0; box-sizing: border-box; font-family: "Montserrat", serif; color: #000; text-rendering: optimizeLegibility; -webkit-font-smoothing: antialiased; } article > * { width: 100%; font-size: 16px; line-height: 1.6; margin: 0; padding: 0; box-sizing: border-box; } article h2, article h3, article h4, article h5, article h6 { text-align: left; font-weight: bold; } article li{ list-style: inside; } article li > * { display: inline !important; margin: 0; font-size: 16px; } article p { padding: 0; width: 100%; } article .caps { font-variant: small-caps; letter-spacing: 0.05em; } article .responsive-table { width: 100%; margin: 20px 0; } article .table-placeholder{ box-shadow: 0 0 10px rgba(0, 0, 0, 0.1); } article .table-row { display: flex; border-bottom: 1px solid #ccc; padding: 10px; gap: 20px; box-sizing: border-box; } article .table-row:last-child { border-bottom: none; } article .table-row.header { font-weight: bold; background-color: #f1f1f1; } article .table-cell { flex: 1; } @media (max-width: 768px) { article .table-row { flex-direction: column; border: 1px solid #ccc; margin-bottom: 10px; padding: 0; gap: 0px; border-bottom: 0; } article .table-row.header { display: none; } article .table-cell { display: flex; padding: 10px; border-bottom: 1px solid #ccc; font-size: 14px; flex-direction: column; } article .table-cell:before { content: attr(data-label) ": "; font-weight: bold; width: 120px; min-width: 120px; margin-right: 10px; } article .table-placeholder{ box-shadow: none; } }

HTTPS & SSL Guide for .boo, .day, .dev, .page, and .rsvp


Quick Answer

Choose or manage the certificate based on the hostnames you need to protect, the validation level, the server platform and whether you control DNS. Keep the private key secure, complete validation, install the full certificate chain and verify the live HTTPS connection before relying on the certificate.


Before You Begin

  • Identify every hostname the certificate must cover.
  • Confirm that you control DNS or the required validation channel.
  • Generate and securely retain the private key when a CSR is required.


NiceNIC Instructions

HTTPS & SSL Configuration Guide To ensure the security of your website and protect your visitors, all domains under.boo,.day,.dev,.page, and.rsvp must use HTTPS. This guide will help you configure SSL/TLS correctly.

  1. What is HTTPS? HTTPS (Hypertext Transfer Protocol Secure) encrypts data between your website and its visitors. It prevents eavesdropping and ensures data integrity.

  2. Obtaining an SSL Certificate NICENIC provides trusted SSL certificates. You can learn more and purchase/configure a certificate here: https://nicenic.com/ssl-certificates/

  3. Installing the SSL Certificate Follow your web server's instructions to install the certificate. Common servers include: Apache: https://httpd.apache.org/docs/current/ssl/ssl_howto.html Nginx: https://nginx.org/en/docs/http/configuring_https_servers.html IIS (Windows): https://docs.microsoft.com/en-us/iis/manage/configuring-security/how-to-set-up-ssl-on-iis

  4. Enforce HTTPS Once your certificate is installed: Redirect all HTTP traffic to HTTPS. Update internal links and resources to use HTTPS. Verify that your website is fully accessible via HTTPS.

  5. Keep Certificates Updated SSL certificates have expiration dates. Ensure certificates are renewed before they expire and check your website regularly to maintain uninterrupted secure connections.


How to Verify

Open the HTTPS site from a clean browser session and inspect the certificate subject, SAN hostnames, issuer, validity dates and chain. Test every hostname covered by the certificate and confirm that HTTP redirects behave as intended.


Troubleshooting

  • DNS validation records are missing, incorrect or added at the wrong DNS provider.
  • The certificate does not include the hostname being opened.
  • The private key does not match the certificate or CSR.
  • The server is missing an intermediate certificate or is still presenting the old certificate.


Frequently Asked Questions

Can I reuse the same certificate after moving servers?

Often the certificate can be reinstalled if you still have the matching private key and the certificate remains valid. Reissue it when the key, CSR or certificate details must change.

Why does the browser still show the old certificate?

The server or load balancer may still present the old certificate, another virtual host may be selected, or an intermediate cache may not have reloaded the configuration.

When should I submit a ticket?

Submit a ticket when validation remains pending after the published records are visible, or when the NiceNIC order does not provide the expected certificate files.


Related NiceNIC Guides


If the issue continues after you complete the checks above, submit a NiceNIC support ticket with the affected domain or product, the exact error message, the time of the issue and the troubleshooting already completed.

]]> http://www.nicenic.com/support/doc.php?IDDoc=4374 How to Set Up and Troubleshoot DNSSEC for Your Domain www.nicenic.com DNS & Nameservers http://www.nicenic.com/support/?IDCate=408 How to Set Up and Troubleshoot DNSSEC for Your Domain?

DNSSEC helps protect your domain’s DNS records from being tampered with during DNS resolution. It adds a layer of verification so that DNS resolvers can confirm the DNS response really comes from the correct source.

At NiceNIC, DNSSEC usually involves two sides:
Your DNS provider or nameserver provider generates the DNSSEC records.
NiceNIC, as your domain registrar, helps submit the DS records to the registry when the TLD supports DNSSEC.

If DNSSEC is not configured correctly, your domain may show DNSSEC errors, or in more serious cases, some users may not be able to access your website.

What Is DNSSEC?
DNSSEC stands for Domain Name System Security Extensions.
In simple terms, DNSSEC helps verify that the DNS answer for your domain has not been changed or forged during the lookup process.
For example, when someone visits your website, DNS is used to find the correct server IP address. DNSSEC helps make sure that the DNS result is authentic and has not been replaced with false data.
DNSSEC does not replace SSL, website security, hosting security, or email security. It only helps protect the DNS resolution process.

When Do You Need DNSSEC?
  1. You may want to enable DNSSEC if:
  2. Your website handles sensitive user information.
  3. You run business email, login systems, payment pages, or customer portals.
  4. You want stronger domain security.
  5. Your DNS provider supports DNSSEC.
  6. Your domain extension supports DNSSEC.
If you are not familiar with DNS management, we recommend confirming with your DNS provider before enabling DNSSEC.
Incorrect DNSSEC settings may affect domain resolution.

Important DNSSEC Terms
DNSKEY: A DNSKEY record is generated by your DNS provider. It is used as part of the DNSSEC validation process.
DS Record: A DS record connects your domain’s DNSSEC setup with the parent registry zone. In most cases, your DNS provider gives you the DS record, and you need to add it through your registrar.
Nameserver: Your nameservers decide where your domain’s DNS records are managed. If you change nameservers, your DNSSEC records may also need to be updated.

How to Enable DNSSEC for Your Domain
Before You Begin: Back Up Your DNS Records
Before enabling DNSSEC, save a copy of your current DNS records, especially important A, AAAA, CNAME, MX, TXT, and CAA records. Enabling DNSSEC does not normally change these records, but keeping a backup makes it easier to verify or restore your DNS configuration if you also change nameservers or DNS providers.
If needed, see: How to Back Up DNS Records Before Changing Domain Settings.

Step 1: Check Whether Your DNS Provider Supports DNSSEC
Log in to the platform where your DNS is managed.
This may be:
Your domain registrar, here is NiceNIC
Your hosting provider
Your DNS provider
Your own DNS server
Another third-party DNS service
Make sure DNSSEC is supported and enabled there.
Important: Enable DNSSEC and DNSSEC signing at your current DNS provider first. Only add the DS record at NiceNIC after your DNS provider has generated the DNSSEC information and is publishing the corresponding DNSKEY. Adding a DS record before the DNS provider is ready may cause DNSSEC validation to fail.

Step 2: Get the DS Record from Your DNS Provider
After enabling DNSSEC, your DNS provider should provide DNSSEC information such as:
Key Tag
Algorithm
Digest Type
Digest
DS Record
Please copy the information exactly as provided.
Even one incorrect character may cause DNSSEC validation failure.

Step 3: Add the DS Record in Your NiceNIC Account
Log in to your NiceNIC account and go to your domain management page.
Then add the DS record provided by your DNS provider.
If you are not sure where to add it, please contact our support team and provide the DS record from your DNS provider.

Step 4: Wait for DNSSEC Propagation
After the DS record is added, it may take some time for the update to propagate.
During this period, DNSSEC check results may not update immediately.

Step 5: Verify DNSSEC Status
After propagation, you may check your domain’s DNSSEC status using a DNSSEC checking tool or by contacting our support team.
If DNSSEC is correctly configured, the DNSSEC validation result should show a valid chain of trust.

When Should You Disable or Remove DNSSEC?
You may need to remove or update DNSSEC records if:
  • You changed your nameservers.
  • You moved DNS management to another provider.
  • Your DNS provider disabled DNSSEC.
  • Your DS record no longer matches the current DNSKEY.
  • Your website or email has DNS resolution issues after a DNS change.
Important: If you are moving to a new DNS provider or changing authoritative nameservers while DNSSEC is enabled, check for existing DS records before making the change.
If the old DS record will no longer match the new DNS provider, remove the old DS record first and wait for its full TTL to expire at the parent zone before changing nameservers. Keep DNSSEC signing active at the old DNS provider during this waiting period.
After the new nameservers are active and DNSSEC signing is enabled at the new DNS provider, obtain the new DS record and add it through NiceNIC.
Changing nameservers while resolvers still have the old DS record cached may cause DNSSEC validation failures and SERVFAIL responses.

Why Does My Domain Return SERVFAIL After Enabling DNSSEC?
SERVFAIL can occur when DNSSEC validation fails. Common causes include:
  • An old or stale DS record from a previous DNS provider
  • A DS record that does not match the DNSKEY published by the current DNS provider
  • Multiple DS records where one or more no longer match an active DNSSEC key
  • DNSSEC signing is not active or the required DNSKEY/RRSIG records are not being published correctly
  • Nameservers were changed before the previous DS record had fully expired from DNS caches
If your domain resolves without DNSSEC validation but returns SERVFAIL through validating resolvers, this is a strong indication of a DNSSEC configuration problem.
Check the current nameservers, all DS records published for the domain, and the DNSKEY information from your active DNS provider. Remove or replace a DS record only after confirming that it is outdated or incorrect. If you are unsure, contact your DNS provider or NiceNIC Support before making changes.

Why Does My Domain Show "DNSSEC Information Is Currently Unavailable"?
You may see this message:
DNSSEC information is currently unavailable for this domain.
This can happen for several reasons:
  • DNSSEC has not been enabled for this domain.
  • No DS record has been added at the registrar level.
  • The domain's current nameservers do not support DNSSEC.
  • The domain recently changed nameservers.
  • The DS record does not match the current DNSKEY.
  • The DNS provider has not published the required DNSSEC records correctly.
  • The registry or DNSSEC query is temporarily unavailable.
This message does not always mean your domain is broken.
However, if your website or email is not resolving correctly, please contact support so we can help review the DNSSEC configuration.

What Information Should I Provide to Support?
To help us check DNSSEC issues faster, please provide:
  1. Your domain name
  2. Your current nameservers
  3. Whether you recently changed nameservers
  4. The DS record provided by your DNS provider
  5. A screenshot of the DNSSEC setting from your DNS provider
  6. Any DNSSEC error message you received
  7. Whether your website or email is currently affected
With this information, our support team can check whether the issue is caused by missing DS records, mismatched DNSSEC records, nameserver changes, or registry-side limitations.

Frequently Asked Questions About DNSSEC

1. Is DNSSEC required for every domain?
No. DNSSEC is not required for every domain.
However, it is recommended for domains that need stronger DNS security, especially business websites, email services, login systems, financial services, and customer portals.
If you are not sure whether you need DNSSEC, please confirm whether your DNS provider supports it and whether you are comfortable managing DNSSEC records.

2. Is DNSSEC the same as SSL?
No.
SSL protects the connection between the user’s browser and your website.
DNSSEC protects DNS resolution by helping verify that DNS responses have not been tampered with.
For better security, many websites use both SSL and DNSSEC, but they are different technologies.

3. Can NiceNIC generate DNSSEC records for me?
In most cases, DNSSEC records are generated by your DNS provider, not by the registrar.
NiceNIC can help submit the DS record to the registry when the domain extension supports DNSSEC.
If you use a third-party DNS provider, please enable DNSSEC there first and then provide us with the DS record.

4. What should I check after changing nameservers, DNS providers, or transferring my domain?
Changing nameservers or DNS providers can affect DNSSEC because the existing DS record may no longer match the DNSKEY published by the new DNS provider.
A registrar transfer by itself does not necessarily mean that your DNSSEC configuration must change. If your nameservers and DNS provider remain the same, first check whether the existing DS record is still present and still matches the current DNSKEY.
If you also changed nameservers or DNS providers, check for old DS records and follow the DNSSEC migration steps above before publishing a new DS record.
Do not assume that DNSSEC was automatically removed during a domain transfer. Always verify the domain’s current DS and DNSKEY status.

5. What happens if the DS record is wrong?
If the DS record does not match the DNSKEY published by your current DNS provider, DNSSEC validation may fail.
This may cause some DNS resolvers to reject the DNS response.
As a result, your website, email, or other services may become unreachable for some users.

6. I do not use DNSSEC. Do I need to do anything?
If you do not use DNSSEC and your domain has no DS records, usually no action is needed.
However, if your domain has old DS records from a previous DNS provider, you should remove them to avoid DNSSEC validation problems.

7. Why does my DNSSEC status still show an error after I updated the record?
DNSSEC updates may take time to propagate.
If you recently added, removed, or changed DS records, please wait for DNS propagation and check again later.
If the issue continues, please contact support and provide your domain name, current nameservers, and DS record.

8. Can DNSSEC cause my website to stop working?
Yes, if DNSSEC is incorrectly configured.
Common causes include:
  • Wrong DS record
  • Old DS record after nameserver change
  • Missing DNSKEY
  • DNS provider not publishing DNSSEC records correctly
  • Expired or invalid DNSSEC signatures
If your website stops working after DNSSEC changes, please contact support immediately.

9. Should I remove DNSSEC before changing nameservers?
In many cases, yes.
If you are moving to a new DNS provider and you are not sure how to migrate DNSSEC safely, removing the old DS record before changing nameservers can reduce the risk of DNSSEC validation failure.
After the new nameservers are active and DNSSEC is enabled at the new DNS provider, you can add the new DS record again.

10. What should I do if I see “Failure to get DNSSEC info”?
This usually means the system could not retrieve valid DNSSEC information for the domain.
Please check:
  • Whether DNSSEC is enabled
  • Whether the DS record has been added
  • Whether the nameservers support DNSSEC
  • Whether the DS record matches the DNSKEY
  • Whether you recently changed nameservers
If you are not sure, please contact NiceNIC support and provide your domain name and DNSSEC details from your DNS provider.

How to set up DNSSEC for a domain registered on NiceNIC?

1. Log in to your NiceNIC account and navigate to your domain management page. Find the domain you wish to enable DNSSEC for and click Manage.

 

2. In the domain management section, you should see the DNSSEC button. Click on the DNSSEC button to access the DNSSEC settings page.
 

3. Enter the required information for DNSSEC configuration (this will typically include DNSSEC key details provided by your DNS hosting provider).
 

4. Once you've entered the information, click Add to enable DNSSEC for the domain. Here’s an example of a successful DNSSEC setup:


 DNSSEC

After entering the necessary DNSSEC key data (usually the DS record), you'll receive confirmation that DNSSEC has been successfully added to your domain settings.
The DNSSEC status will show as enabled and you'll be able to see the public keys and other details.
With DNSSEC now enabled, your domain is better protected against DNS-related attacks.

Attention: if your domain name was transferred into NiceNIC from another Registrar, and you hope to disable the DNSSEC previously with the old Registrar, please firstly check the latest whois, if you see "DNSSEC: unsigned", then it means during the domain transfer process, the DNSSEC settings have been disabled automatically by the old Registrar, while if it is "DNSSEC: signed", please check the domain management section at your control panel at NiceNIC, you should see the DNSSEC button, please click on the DNSSEC button to access the DNSSEC settings page.
]]> http://www.nicenic.com/support/doc.php?IDDoc=3845 What Happens to My Nameservers After a Domain Transfer? www.nicenic.com Domain Transfers http://www.nicenic.com/support/?IDCate=313 Status of Name Servers After a Domain Transfer


After the domain is transferred, the name servers remain set to those associated to the domain before transfer.


If you had child name servers for your domain registered through another Registrar, you may need to register them again through your Account.

]]> http://www.nicenic.com/support/doc.php?IDDoc=3847 How to Transfer Name Servers During a Domain Transfer? www.nicenic.com Domain Transfers http://www.nicenic.com/support/?IDCate=313

How to Transfer Name Servers During a Domain Transfer?


Quick Answer

A successful domain transfer depends on the domain's eligibility, lock status, authorization method, registrant access and registry rules. Prepare the domain before ordering the transfer, keep the existing DNS active, and monitor the transfer until completion.


Before You Begin

  • Confirm the domain and registrant email are accessible.
  • Record the current nameservers and DNS records.
  • Check the domain's expiry date, lock status and any TLD-specific transfer rule.


NiceNIC Instructions

Transferring nameservers During a Domain Transfer If you're just transferring the domain registration, your hosting service will be unaffected, and there will be no need to change nameservers. Although the nameservers should be transferred as part of the process, it's always a good idea to have a record of them. If you wish to specify the nameservers to the default DNS servers as provided by NiceNIC you can reset the nameservers after the transfer has been completed. Steps Login to your account. Select the Domain Names tab. Select the domain that you want to change nameservers for.

From within the DNS Servers section click on Edit DNS Server. Change the nameservers as required, leaving any of the fields blank will retain the original DNS server. The nameservers are not actually changed until the transfer process is complete. If you wish to make an immediate change to the nameservers, you may do so with the Registrar you are transferring from.


How to Verify

Check the transfer status in NiceNIC, confirm the registrar of record after completion, verify the authoritative nameservers, and test website and email resolution. Do not treat payment alone as proof that the transfer completed.


Troubleshooting

  • The domain is locked, too new, recently transferred or otherwise restricted by policy.
  • The EPP/Auth code is missing, expired or copied incorrectly.
  • The approval email cannot be received or the registrant data is under verification.
  • The domain or related DNS service expires while the transfer is pending.


Frequently Asked Questions

Does a transfer change my nameservers?

A registrar transfer normally keeps the current nameservers, but you should record and verify them before and after the transfer.

Can I edit the domain while a transfer is pending?

Some settings may be restricted during a pending transfer. Avoid unnecessary ownership, lock or DNS changes until the transfer completes.

When should I submit a ticket?

Submit a ticket when the status is unclear, a TLD uses a special transfer process, or the transfer remains blocked after you correct the stated issue.


Related NiceNIC Guides


If the issue continues after you complete the checks above, submit a NiceNIC support ticket with the affected domain or product, the exact error message, the time of the issue and the troubleshooting already completed.

]]> http://www.nicenic.com/support/doc.php?IDDoc=3846 How do I verify that my domain is eligible for transfer? www.nicenic.com Domain Transfers http://www.nicenic.com/support/?IDCate=313 body { margin: 0; padding: 0; } article { width: 100%; max-width: 100%; margin: 0; padding: 0; box-sizing: border-box; font-family: "Montserrat", serif; color: #000; text-rendering: optimizeLegibility; -webkit-font-smoothing: antialiased; } article > * { width: 100%; font-size: 16px; line-height: 1.6; margin: 0; padding: 0; box-sizing: border-box; } article h2, article h3, article h4, article h5, article h6 { text-align: left; font-weight: bold; } article li{ list-style: inside; } article li > * { display: inline !important; margin: 0; font-size: 16px; } article p { padding: 0; width: 100%; } article .caps { font-variant: small-caps; letter-spacing: 0.05em; } article .responsive-table { width: 100%; margin: 20px 0; } article .table-placeholder{ box-shadow: 0 0 10px rgba(0, 0, 0, 0.1); } article .table-row { display: flex; border-bottom: 1px solid #ccc; padding: 10px; gap: 20px; box-sizing: border-box; } article .table-row:last-child { border-bottom: none; } article .table-row.header { font-weight: bold; background-color: #f1f1f1; } article .table-cell { flex: 1; } @media (max-width: 768px) { article .table-row { flex-direction: column; border: 1px solid #ccc; margin-bottom: 10px; padding: 0; gap: 0px; border-bottom: 0; } article .table-row.header { display: none; } article .table-cell { display: flex; padding: 10px; border-bottom: 1px solid #ccc; font-size: 14px; flex-direction: column; } article .table-cell:before { content: attr(data-label) ": "; font-weight: bold; width: 120px; min-width: 120px; margin-right: 10px; } article .table-placeholder{ box-shadow: none; } }

How to Check Whether a Domain Is Eligible for Transfer


Quick Answer

Before starting a transfer, confirm that the domain is active, unlocked, not restricted by a transfer lock or dispute, and eligible under the registry's rules. Make sure you can receive approval messages and obtain the EPP/Auth code when the TLD requires one.


Before You Begin

  • Confirm the domain and registrant email are accessible.
  • Record the current nameservers and DNS records.
  • Check the domain's expiry date, lock status and any TLD-specific transfer rule.


NiceNIC Instructions

Before purchasing the transfer of any gTLD (e.g.,.COM /.NET /.ORG /.BIZ /.INFO etc.) or new gTLD (e.g..CLUB /.CLOUD /.TRADE /.TOP etc.), make sure your domain meets the following conditions:

  1. Your domain was registered or transferred at least 60 days ago;

  2. The domain is unlocked at the current Registrar (its WHOIS status should be OK or Active). Also,you need to request an up-to-date Auth/EPPcode for the domain at your current Registrar. If all criteria are met, you should be able to complete the transfer successfully. Still, some ccTLDs (.ES and.UK) have additional transfer requirements and/or exclude some points from the list above.

NOTE: Make sure the domain status is active, not expired. If you wish to transfer an expired domain to NiceNIC, please contact our Support Team email support@nicenic.net for further assistance.


How to Verify

Check the transfer status in NiceNIC, confirm the registrar of record after completion, verify the authoritative nameservers, and test website and email resolution. Do not treat payment alone as proof that the transfer completed.


Troubleshooting

  • The domain is locked, too new, recently transferred or otherwise restricted by policy.
  • The EPP/Auth code is missing, expired or copied incorrectly.
  • The approval email cannot be received or the registrant data is under verification.
  • The domain or related DNS service expires while the transfer is pending.


Frequently Asked Questions

Does a transfer change my nameservers?

A registrar transfer normally keeps the current nameservers, but you should record and verify them before and after the transfer.

Can I edit the domain while a transfer is pending?

Some settings may be restricted during a pending transfer. Avoid unnecessary ownership, lock or DNS changes until the transfer completes.

When should I submit a ticket?

Submit a ticket when the status is unclear, a TLD uses a special transfer process, or the transfer remains blocked after you correct the stated issue.


Related NiceNIC Guides


If the issue continues after you complete the checks above, submit a NiceNIC support ticket with the affected domain or product, the exact error message, the time of the issue and the troubleshooting already completed.

]]> http://www.nicenic.com/support/doc.php?IDDoc=3842 How to transfer several domains to NiceNIC in bulk? www.nicenic.com Domain Transfers http://www.nicenic.com/support/?IDCate=313 How to transfer several domains to NiceNIC in bulk?


Before submitting a transfer request with NiceNIC, make sure your domains are prepared for transfer through your current registrar. This is generally done by removing transfer locks and getting the necessary Auth codes.


Before You Begin

- Confirm the domain and registrant email are accessible.
- Record the current nameservers and DNS records.
- Check the domain's expiry date, lock status and any TLD-specific transfer rule.

Learn how to prepare domains for transfer in accounts sections of several popular registrars.

Once those preparations are made, simply follow the steps below to transfer your domains:


Note: Each domain has a unique Auth code and has to be unlocked for transfer separately on the current registrar side.


  • Log in to your NiceNIC account.
  • Go to the Transfer to Us page.
  • Click on Bulk options.


bulk transfer

bulk transfer


Enter the domain names and the Auth codes;


Note: Enter each domain and its Auth code in a new line. The Auth code has to be separated from the domain name by a comma and one space.


Click on Start Transfer at the bottom of the page.

Double-check the domain names and add them to Cart. To do this, you can use the Add all to cart button for convenience.
Proceed with the payment.

The transfer is completed automatically in 5-7 days for most domains. Once the transfer of your domains is completed you will receive the notifications on your NiceNIC Primary Email address, and the domains will become manageable in your Domain List.


Note: Due to technical reasons, it is only possible to submit the transfer for up to 500 domain names at once. If you need to transfer more than 10 domains, you can either submit several Bulk Transfer orders or contact our Support Team for assistance.




How to Check the Status of Your Domain Transfer

After initiating a domain transfer to Nicenic, you can monitor its progress directly in your account. This helps you know when the transfer is expected to complete without needing to contact support repeatedly.

Steps to View Transfer Status:

1. Log in to your NiceNIC account. Go to "My Products > Domain Names".
In the Status column, you will see your domain listed as:

  • Pending Transfer: the transfer has been submitted and is in progress.
  • Active / Transfer Completed: the transfer is finished.


domain transfer

2. Hover over the information icon (i) next to "Pending Transfer" to view details about Expected approval/completion date

domain transfer


Related NiceNIC Guides


If the issue continues after you complete the checks above, submit a NiceNIC support ticket with the affected domain or product, the exact error message, the time of the issue and the troubleshooting already completed.

]]> http://www.nicenic.com/support/doc.php?IDDoc=3833 What is SPF and How to Set Up SPF? www.nicenic.com Business Email http://www.nicenic.com/support/?IDCate=290 body { margin: 0; padding: 0; } article { width: 100%; max-width: 100%; margin: 0; padding: 0; box-sizing: border-box; font-family: "Montserrat", serif; color: #000; text-rendering: optimizeLegibility; -webkit-font-smoothing: antialiased; } article > * { width: 100%; font-size: 16px; line-height: 1.6; margin: 0; padding: 0; box-sizing: border-box; } article h2, article h3, article h4, article h5, article h6 { text-align: left; font-weight: bold; } article li{ list-style: inside; } article li > * { display: inline !important; margin: 0; font-size: 16px; } article p { padding: 0; width: 100%; } article .caps { font-variant: small-caps; letter-spacing: 0.05em; } article .responsive-table { width: 100%; margin: 20px 0; } article .table-placeholder{ box-shadow: 0 0 10px rgba(0, 0, 0, 0.1); } article .table-row { display: flex; border-bottom: 1px solid #ccc; padding: 10px; gap: 20px; box-sizing: border-box; } article .table-row:last-child { border-bottom: none; } article .table-row.header { font-weight: bold; background-color: #f1f1f1; } article .table-cell { flex: 1; } @media (max-width: 768px) { article .table-row { flex-direction: column; border: 1px solid #ccc; margin-bottom: 10px; padding: 0; gap: 0px; border-bottom: 0; } article .table-row.header { display: none; } article .table-cell { display: flex; padding: 10px; border-bottom: 1px solid #ccc; font-size: 14px; flex-direction: column; } article .table-cell:before { content: attr(data-label) ": "; font-weight: bold; width: 120px; min-width: 120px; margin-right: 10px; } article .table-placeholder{ box-shadow: none; } }

What is SPF and How to Set Up SPF?


SPF (Sender Policy Framework) is a DNS-published email authentication policy that identifies which mail servers may send mail using a domain in the SMTP envelope sender. SPF is one part of email authentication; it does not replace DKIM or DMARC and does not, by itself, guarantee delivery.



Before you publish SPF

List every legitimate outgoing email service used by your domain: a business mailbox, website form, helpdesk, bulk-email provider or other sender. Obtain the exact SPF instructions from each provider. The DNS zone must be edited wherever the domain's authoritative nameservers are hosted.


Valid SPF syntax

These are syntax examples, not ready-made NiceNIC mail settings:

example.com. IN TXT "v=spf1 ip4:192.0.2.10 -all"

The ip4: mechanism must be followed by a numeric IPv4 address or CIDR range, never by a hostname. The address 192.0.2.10 is reserved for documentation.

example.com. IN TXT "v=spf1 a mx include:_spf.mail-provider.example ~all"

Here, a authorizes hosts resolved by the sender domain's A/AAAA records, mx authorizes the IPs of the domain's MX hosts, and include: delegates a check to another SPF record. Use only mechanisms your actual email provider requires. Replace the fictional provider domain before publishing.

  • -all means unauthorized senders should fail SPF.
  • ~all indicates softfail; some providers recommend it during rollout.
  • ?all means neutral; it is not a substitute for confirming your senders.
  • Avoid the deprecated ptr mechanism and do not combine multiple complete v=spf1 policies.


Set up SPF

  1. Check existing TXT records for v=spf1 at the hostname you send from.
  2. Combine all approved mail services into one SPF policy for that hostname; do not add a second competing SPF TXT record.
  3. If NiceNIC is your DNS host, open My Products > Domain > DNS Records, edit/create a TXT record at the specified host, and paste the validated policy.

  1. Save. Check the published value using dig TXT example.com or nslookup -type=TXT example.com.

  1. Send a test message to an external mailbox and inspect its authentication results. A DNS lookup alone does not confirm SPF passes for every sender.


When SPF fails

Check the sending server's actual public IP, whether the recipient evaluates the intended envelope sender domain, and whether the SPF record exceeds the DNS-lookup limit in RFC 7208. Do not use unverified third-party IPs or include: domains. If you use NiceNIC Business Email, request the current provider-approved SPF value from the email settings or support team before publishing it.


Related NiceNIC Guides

]]> http://www.nicenic.com/support/doc.php?IDDoc=3912 How to verify certificate installation correctly www.nicenic.com SSL Certificates http://www.nicenic.com/support/?IDCate=294 body { margin: 0; padding: 0; } article { width: 100%; max-width: 100%; margin: 0; padding: 0; box-sizing: border-box; font-family: "Montserrat", serif; color: #000; text-rendering: optimizeLegibility; -webkit-font-smoothing: antialiased; } article > * { width: 100%; font-size: 16px; line-height: 1.6; margin: 0; padding: 0; box-sizing: border-box; } article h2, article h3, article h4, article h5, article h6 { text-align: left; font-weight: bold; } article li{ list-style: inside; } article li > * { display: inline !important; margin: 0; font-size: 16px; } article p { padding: 0; width: 100%; } article .caps { font-variant: small-caps; letter-spacing: 0.05em; } article .responsive-table { width: 100%; margin: 20px 0; } article .table-placeholder{ box-shadow: 0 0 10px rgba(0, 0, 0, 0.1); } article .table-row { display: flex; border-bottom: 1px solid #ccc; padding: 10px; gap: 20px; box-sizing: border-box; } article .table-row:last-child { border-bottom: none; } article .table-row.header { font-weight: bold; background-color: #f1f1f1; } article .table-cell { flex: 1; } @media (max-width: 768px) { article .table-row { flex-direction: column; border: 1px solid #ccc; margin-bottom: 10px; padding: 0; gap: 0px; border-bottom: 0; } article .table-row.header { display: none; } article .table-cell { display: flex; padding: 10px; border-bottom: 1px solid #ccc; font-size: 14px; flex-direction: column; } article .table-cell:before { content: attr(data-label) ": "; font-weight: bold; width: 120px; min-width: 120px; margin-right: 10px; } article .table-placeholder{ box-shadow: none; } }

How to verify certificate installation correctly


Do not verify an SSL installation by looking for a website seal or by checking that the browser no longer shows a warning on one computer. Verify the TLS connection presented by the actual public hostname.


The checks that matter

  1. Visit https://your-domain.example on a clean browser session. Confirm there is no certificate-name, expiry or trust warning.
  2. Inspect the certificate's Subject Alternative Name (SAN) list. It must cover the hostname you requested, including www if your site uses it.
  3. Confirm the certificate is within its validity interval and the server sends a complete, trusted chain to an appropriate public root.
  4. Test whether the site redirects HTTP traffic to HTTPS as intended and does not load insecure assets ("mixed content").
  5. If your service has several IPs, load balancers, CDN edges or IPv6 endpoints, test each relevant route; one server may still have an old certificate.


Command-line check

openssl s_client -connect example.com:443 -servername example.com 

-verify_hostname example.com -verify_return_error -showcerts

Replace example.com with your hostname. Check the hostname-verification and certificate-chain result; the -verify_hostname option is important because displaying the chain alone does not validate the requested hostname. These flags rely on the local OpenSSL trust store. Inspect any missing intermediates. For a hostname/path overview, you can also use a reputable external TLS diagnostic service, but do not send credentials or customer data.


Common problems

Symptom
Likely area to inspect
Name mismatch
Missing or incorrect SAN / wrong virtual host
Expired certificate
Replacement not deployed everywhere
Untrusted issuer
Missing chain or private CA used unintentionally
Old certificate after update
CDN cache/configuration, SNI or load balancer node
HTTPS page loads with warning
Mixed HTTP assets or insecure embedded content

A certificate "trust badge" is optional marketing UI; it is not required for successful TLS deployment. If something fails, give NiceNIC Support the hostname, UTC test time, observed certificate dates and non-sensitive error text―not your private key.


Verify every advertised hostname, not just one URL

A company may serve example.com, www.example.com, shop.example.com and api.example.com from different TLS endpoints. Test each hostname's actual live certificate: SAN coverage, trusted chain, issuance/expiry and HTTP-to-HTTPS behavior. A certificate valid on www does not prove the API hostname is safe.

Use the OpenSSL hostname-verification command shown above or an external TLS test for each hostname. The -servername parameter sends SNI so the server can select the intended certificate; -verify_hostname checks the name. Replace both arguments with the exact live hostname. Examine exit status, validation output and the certificate dates, then test on a second network if practical.


Three common failures

  • Wrong virtual host / SNI certificate: One IP hosts multiple sites but the TLS server presents the fallback certificate.
  • Incomplete intermediate chain: The leaf certificate is correctly issued, but some clients cannot chain it to a trusted root.
  • Old deployment still active: One CDN edge, IPv6 service or load-balancer node still serves an expired certificate while other routes work.

For customer support, record the hostname, resolved IP or CDN endpoint, test time and error; never attach the private key.


Related NiceNIC Guides

]]> http://www.nicenic.com/support/doc.php?IDDoc=3910 SSL Certification in Four Simple Steps www.nicenic.com SSL Certificates http://www.nicenic.com/support/?IDCate=294 body { margin: 0; padding: 0; } article { width: 100%; max-width: 100%; margin: 0; padding: 0; box-sizing: border-box; font-family: "Montserrat", serif; color: #000; text-rendering: optimizeLegibility; -webkit-font-smoothing: antialiased; } article > * { width: 100%; font-size: 16px; line-height: 1.6; margin: 0; padding: 0; box-sizing: border-box; } article h2, article h3, article h4, article h5, article h6 { text-align: left; font-weight: bold; } article li{ list-style: inside; } article li > * { display: inline !important; margin: 0; font-size: 16px; } article p { padding: 0; width: 100%; } article .caps { font-variant: small-caps; letter-spacing: 0.05em; } article .responsive-table { width: 100%; margin: 20px 0; } article .table-placeholder{ box-shadow: 0 0 10px rgba(0, 0, 0, 0.1); } article .table-row { display: flex; border-bottom: 1px solid #ccc; padding: 10px; gap: 20px; box-sizing: border-box; } article .table-row:last-child { border-bottom: none; } article .table-row.header { font-weight: bold; background-color: #f1f1f1; } article .table-cell { flex: 1; } @media (max-width: 768px) { article .table-row { flex-direction: column; border: 1px solid #ccc; margin-bottom: 10px; padding: 0; gap: 0px; border-bottom: 0; } article .table-row.header { display: none; } article .table-cell { display: flex; padding: 10px; border-bottom: 1px solid #ccc; font-size: 14px; flex-direction: column; } article .table-cell:before { content: attr(data-label) ": "; font-weight: bold; width: 120px; min-width: 120px; margin-right: 10px; } article .table-placeholder{ box-shadow: none; } }

SSL Certification in Four Simple Steps


For a normal website, activating an SSL certificate involves four distinct tasks: purchase the right coverage, prove domain control, receive the certificate, and install/verify it on the server. These steps are not interchangeable.



Step 1 ― Choose coverage and order

List the hostnames that must use HTTPS, such as example.com and www.example.com. Confirm whether you need single-name, wildcard or SAN coverage; choose DV/OV/EV validation according to your actual identity requirements. Check price and deployment responsibilities before ordering.


Step 2 ― Activate and validate

Find the SSL order in your NiceNIC account and open the available activation flow. Submit a CSR when the product requires it, without disclosing the private key. Complete the certificate authority's permitted domain-control validation (for example, a DNS challenge or another supported method). OV/EV products may also require legal-entity information.


Step 3 ― Receive and install

Download the issued certificate and intermediate chain. Install them on the actual TLS termination point (hosting server, load balancer, proxy or CDN) with the matching private key. The correct process depends on the server software; use the platform's current instructions.



Step 4 ― Verify, then plan replacement

Check the external HTTPS connection, certificate SAN list, trust chain, validity and any mixed-content warnings. Test additional hostnames and IPv6/CDN endpoints where used.

Public TLS server certificates issued on or after March 15, 2026 have a maximum validity period of 200 days, so monitor the installed certificate even if you have paid for a longer service plan.

If you are stuck at validation, provide NiceNIC Support with the order number, hostname and non-sensitive status―never the private key.


Example: issuing HTTPS for a two-hostname site

A company owns example.com and wants both example.com and www.example.com to work over HTTPS.

  1. Select coverage: Verify the certificate product supports both names in the SAN list, or acquire the correct additional certificate. Do not assume a single-host order covers www.
  2. Validate control: The CA may provide a DNS TXT/CNAME or HTTP token. Place it at the authoritative DNS host or approved web location, wait for validation and do not delete verification data prematurely.
  3. Install: Deploy the certificate, chain and matching private key on the actual web server or CDN endpoint. If several nodes serve traffic, update them all.
  4. Verify externally: Check both URLs, certificate hostnames, validity and trust chain; then set a reminder for renewal and replacement based on the installed Not After.


Time and responsibility checklist

The domain owner maintains control of DNS or HTTP challenges, the CA issues the certificate after verification, and the server administrator installs it. These can be different parties. A delay at one stage should not be described as a generic "SSL failure." Keep the order status, CA validation status and live HTTPS status separately.


Related NiceNIC Guides

]]> http://www.nicenic.com/support/doc.php?IDDoc=3908 SSL certificate purpose explained www.nicenic.com SSL Certificates http://www.nicenic.com/support/?IDCate=294 body { margin: 0; padding: 0; } article { width: 100%; max-width: 100%; margin: 0; padding: 0; box-sizing: border-box; font-family: "Montserrat", serif; color: #000; text-rendering: optimizeLegibility; -webkit-font-smoothing: antialiased; } article > * { width: 100%; font-size: 16px; line-height: 1.6; margin: 0; padding: 0; box-sizing: border-box; } article h2, article h3, article h4, article h5, article h6 { text-align: left; font-weight: bold; } article li{ list-style: inside; } article li > * { display: inline !important; margin: 0; font-size: 16px; } article p { padding: 0; width: 100%; } article .caps { font-variant: small-caps; letter-spacing: 0.05em; } article .responsive-table { width: 100%; margin: 20px 0; } article .table-placeholder{ box-shadow: 0 0 10px rgba(0, 0, 0, 0.1); } article .table-row { display: flex; border-bottom: 1px solid #ccc; padding: 10px; gap: 20px; box-sizing: border-box; } article .table-row:last-child { border-bottom: none; } article .table-row.header { font-weight: bold; background-color: #f1f1f1; } article .table-cell { flex: 1; } @media (max-width: 768px) { article .table-row { flex-direction: column; border: 1px solid #ccc; margin-bottom: 10px; padding: 0; gap: 0px; border-bottom: 0; } article .table-row.header { display: none; } article .table-cell { display: flex; padding: 10px; border-bottom: 1px solid #ccc; font-size: 14px; flex-direction: column; } article .table-cell:before { content: attr(data-label) ": "; font-weight: bold; width: 120px; min-width: 120px; margin-right: 10px; } article .table-placeholder{ box-shadow: none; } }

SSL certificate purpose explained


An SSL/TLS certificate enables a browser or application to establish HTTPS with a server that controls the certificate's private key and is authorized for the requested hostname. The purpose is to protect data in transit and authenticate the connection endpoint―not to certify every part of a business.


What HTTPS protects

  • Confidentiality in transit: network observers generally cannot read the encrypted page content or submitted form data.
  • Integrity in transit: encryption makes undetected modifications by parties on the network much harder.
  • Hostname authentication: the client checks the certificate chain and Subject Alternative Name to ensure it matches the site it requested.


What it does not do

A valid HTTPS padlock does not mean the site is free of malware, fraud, weak passwords, vulnerable applications or insecure third-party scripts. A phishing website can also have a valid DV certificate. Browser HTTPS is a baseline security control, not a guarantee of a trustworthy merchant.

Search engines may use HTTPS among many site-quality signals, but buying a certificate does not guarantee higher ranking or traffic. More important is maintaining a technically sound, accessible and useful website.


Put TLS to work correctly

Get a certificate for every hostname you serve; keep keys private; install the right intermediates; redirect HTTP visitors safely to HTTPS; remove mixed-content warnings; and test mobile and desktop clients. Set renewal alerts based on the installed certificate expiration.

As of March 2026, newly issued public TLS server certificates have a maximum validity of 200 days, making replacement planning especially important. See How to Choose an SSL Certificate for coverage and validation choices.


What changes when you switch from HTTP to HTTPS?

On an HTTP connection, an intermediary on the network can potentially inspect or modify unprotected requests and responses. When a client connects over correctly configured HTTPS, TLS establishes an encrypted, integrity-protected channel to the endpoint authenticated by the certificate.

That is useful for:

  • Logins: helping protect credentials while they travel between browser and server;
  • Checkout/contact forms: protecting data in transit, even when a third-party payment provider processes the final transaction;
  • APIs: protecting access tokens and responses over networks;
  • Public pages: reducing the risk of injected advertisements or modified content on unsecured networks.


What certificate labels actually compare

Product
Extra identity checks
Encryption advantage over another correctly configured TLS cert
DV
Domain control
No intrinsic advantage
OV
Validated organization identity
No intrinsic advantage
EV
Enhanced legal-entity verification
No intrinsic advantage

TLS cannot correct malicious software on the server, a stolen administrator password or deceptive website content. Pair HTTPS with software updates, access control, security monitoring and sensible data handling.


Related NiceNIC Guides

]]> http://www.nicenic.com/support/doc.php?IDDoc=3907 How to choose an SSL certificate www.nicenic.com SSL Certificates http://www.nicenic.com/support/?IDCate=294 body { margin: 0; padding: 0; } article { width: 100%; max-width: 100%; margin: 0; padding: 0; box-sizing: border-box; font-family: "Montserrat", serif; color: #000; text-rendering: optimizeLegibility; -webkit-font-smoothing: antialiased; } article > * { width: 100%; font-size: 16px; line-height: 1.6; margin: 0; padding: 0; box-sizing: border-box; } article h2, article h3, article h4, article h5, article h6 { text-align: left; font-weight: bold; } article li{ list-style: inside; } article li > * { display: inline !important; margin: 0; font-size: 16px; } article p { padding: 0; width: 100%; } article .caps { font-variant: small-caps; letter-spacing: 0.05em; } article .responsive-table { width: 100%; margin: 20px 0; } article .table-placeholder{ box-shadow: 0 0 10px rgba(0, 0, 0, 0.1); } article .table-row { display: flex; border-bottom: 1px solid #ccc; padding: 10px; gap: 20px; box-sizing: border-box; } article .table-row:last-child { border-bottom: none; } article .table-row.header { font-weight: bold; background-color: #f1f1f1; } article .table-cell { flex: 1; } @media (max-width: 768px) { article .table-row { flex-direction: column; border: 1px solid #ccc; margin-bottom: 10px; padding: 0; gap: 0px; border-bottom: 0; } article .table-row.header { display: none; } article .table-cell { display: flex; padding: 10px; border-bottom: 1px solid #ccc; font-size: 14px; flex-direction: column; } article .table-cell:before { content: attr(data-label) ": "; font-weight: bold; width: 120px; min-width: 120px; margin-right: 10px; } article .table-placeholder{ box-shadow: none; } }

How to choose an SSL certificate


Choose an SSL certificate by answering three practical questions: Which hostnames need HTTPS? Who must be verified? Who will install and renew the certificate? A more expensive certificate is not automatically better protection for a normal website.


1. Decide which names to cover

Need
Typical product
One hostname
Single-name certificate
A base domain and selected additional names
Multi-domain/SAN certificate, subject to product limits
Many first-level subdomains such as shop.example.com
Wildcard certificate for *.example.com

A wildcard for *.example.com does not automatically protect nested names such as a.shop.example.com, and the apex example.com must also be covered explicitly if needed.


2. Choose validation level separately

  • DV validates control of the domain. Suitable for most blogs, shops, app endpoints and APIs.
  • OV adds organization identity verification and may fit corporate procurement requirements.
  • EV involves more extensive legal-entity checks; browser UI does not guarantee a prominent company-name display.

All properly deployed public TLS certificate types provide transport encryption. None proves a site's content is safe from all attacks.


3. Match your deployment workflow

Confirm whether the hostname points to a shared host, IIS/Apache/Nginx server, CDN, load balancer or managed platform. Check that you can perform DNS/HTTP validation, preserve the private key and install the full chain. SNI commonly allows HTTPS hosting without a dedicated IPv4 address.


4. Plan renewal before buying

Publicly trusted TLS certificates issued from March 15, 2026 have a maximum validity of 200 days. Choose a product and hosting setup that supports frequent replacement, ideally automated where verified. Compare the subscription price and renewal assistance, not just the first certificate issue.

After choosing a product, continue with How to Generate a CSR and How to Install SSL Certificates.


Three real purchasing scenarios

Scenario A ― single company website. example.com and www.example.com both need HTTPS. A single-name certificate is not enough unless its SANs include both names. Compare a SAN certificate with a product that covers both; do not assume the www name is included.

Scenario B ― SaaS with many customer-facing subdomains. app.example.com, admin.example.com and docs.example.com may fit a wildcard for *.example.com. A deeper hostname such as api.eu.example.com does not match that wildcard and needs separate coverage. Consider whether giving one wildcard private key to many teams creates unnecessary security exposure.

Scenario C ― enterprise procurement. A customer asks for documented company identity. Compare OV and EV vetting rather than treating EV as stronger transport encryption. Ask which identity data the CA validates and what evidence your procurement team needs.


A quick selection matrix

Question
If yes
If no
Do you control all names via one platform?
Automation may be convenient
Plan for separate certificate installation points
Do you need many first-level subdomains?
Consider wildcard coverage
SAN or single-host products may be simpler
Do you need organization identity validation?
Compare OV/EV
DV may be sufficient
Can you automate reissuance during the subscription?
Lower operational renewal risk
Add explicit renewal/replacement reminders

Review the total service cost, covered names and installation responsibilities before buying―not only the displayed validation badge.


Related NiceNIC Guides

]]> http://www.nicenic.com/support/doc.php?IDDoc=3906 How do I renew an SSL certificate www.nicenic.com SSL Certificates http://www.nicenic.com/support/?IDCate=294 body { margin: 0; padding: 0; } article { width: 100%; max-width: 100%; margin: 0; padding: 0; box-sizing: border-box; font-family: "Montserrat", serif; color: #000; text-rendering: optimizeLegibility; -webkit-font-smoothing: antialiased; } article > * { width: 100%; font-size: 16px; line-height: 1.6; margin: 0; padding: 0; box-sizing: border-box; } article h2, article h3, article h4, article h5, article h6 { text-align: left; font-weight: bold; } article li{ list-style: inside; } article li > * { display: inline !important; margin: 0; font-size: 16px; } article p { padding: 0; width: 100%; } article .caps { font-variant: small-caps; letter-spacing: 0.05em; } article .responsive-table { width: 100%; margin: 20px 0; } article .table-placeholder{ box-shadow: 0 0 10px rgba(0, 0, 0, 0.1); } article .table-row { display: flex; border-bottom: 1px solid #ccc; padding: 10px; gap: 20px; box-sizing: border-box; } article .table-row:last-child { border-bottom: none; } article .table-row.header { font-weight: bold; background-color: #f1f1f1; } article .table-cell { flex: 1; } @media (max-width: 768px) { article .table-row { flex-direction: column; border: 1px solid #ccc; margin-bottom: 10px; padding: 0; gap: 0px; border-bottom: 0; } article .table-row.header { display: none; } article .table-cell { display: flex; padding: 10px; border-bottom: 1px solid #ccc; font-size: 14px; flex-direction: column; } article .table-cell:before { content: attr(data-label) ": "; font-weight: bold; width: 120px; min-width: 120px; margin-right: 10px; } article .table-placeholder{ box-shadow: none; } }

How do I renew an SSL certificate


Renewing an SSL certificate service and replacing the certificate installed on your website are related but different tasks. A successful payment does not update the certificate on your server automatically unless your specific product and hosting integration do so.


Renewal checklist

  1. Open the existing NiceNIC SSL order and check its service renewal date, certificate product and covered hostnames.
  2. Review the current renewal price and available renewal/extension option. Complete payment through the official account flow.
  3. Check the actual installed TLS certificate's expiration date (Not After) separately from the order's paid term.
  4. When a new certificate is needed, create or reuse an eligible CSR and complete the CA's domain-control validation. Some products may automate this step.
  5. Download the new certificate and any intermediate chain; update the web server, reverse proxy, CDN or load balancer that terminates HTTPS.

  1. Test the HTTPS endpoint from outside the server for the expected SANs, chain and new expiration date.


Why can a multi-year order still need new certificates?

Under the CA/Browser Forum requirements, publicly trusted TLS certificates issued on or after March 15, 2026 are limited to 200 days of validity. Therefore, a service plan advertised for longer than 200 days requires repeat issuance/replacement; it is not one long-lived certificate.

If the site still shows the old expiry date

Check whether traffic passes through a CDN or another TLS endpoint, whether the service was reloaded after installation, and whether all servers received the new certificate. If you cannot locate the reissue/renewal option, include your SSL order number and non-sensitive error message in a NiceNIC support ticket.


Example: a multi-year SSL service is not one multi-year certificate

Suppose your SSL product has a one-year paid service period but the public certificate issued today can only be valid for up to 200 days under the current baseline requirements. The certificate may need a replacement during the paid year. If you renew the service, that billing action is separate from replacing the certificate on your website.

Clock
What it controls
How to check
Service/subscription expiry
Whether the provider continues to supply the paid SSL product
NiceNIC SSL order or subscription record
Certificate Not After
Whether browsers accept this particular deployed certificate after the date
Browser certificate viewer or OpenSSL
Domain registration expiry
Whether the underlying domain remains registered and usable
NiceNIC domain account / registry record

Operational example: Your paid SSL subscription remains active until December, but the deployed certificate expires in August. The browser warning in August is a certificate lifecycle incident, not a reason to assume your domain or entire service subscription expired. Issue and deploy the replacement before the Not After date.

Set alert thresholds in days before certificate expiry and confirm automated replacement actually updated each CDN edge or server. Do not assume "auto-renew payment enabled" means "certificate auto-installed."


Related NiceNIC Guides

]]> http://www.nicenic.com/support/doc.php?IDDoc=3905 How do I reissue my SSL certificate www.nicenic.com SSL Certificates http://www.nicenic.com/support/?IDCate=294 body { margin: 0; padding: 0; } article { width: 100%; max-width: 100%; margin: 0; padding: 0; box-sizing: border-box; font-family: "Montserrat", serif; color: #000; text-rendering: optimizeLegibility; -webkit-font-smoothing: antialiased; } article > * { width: 100%; font-size: 16px; line-height: 1.6; margin: 0; padding: 0; box-sizing: border-box; } article h2, article h3, article h4, article h5, article h6 { text-align: left; font-weight: bold; } article li{ list-style: inside; } article li > * { display: inline !important; margin: 0; font-size: 16px; } article p { padding: 0; width: 100%; } article .caps { font-variant: small-caps; letter-spacing: 0.05em; } article .responsive-table { width: 100%; margin: 20px 0; } article .table-placeholder{ box-shadow: 0 0 10px rgba(0, 0, 0, 0.1); } article .table-row { display: flex; border-bottom: 1px solid #ccc; padding: 10px; gap: 20px; box-sizing: border-box; } article .table-row:last-child { border-bottom: none; } article .table-row.header { font-weight: bold; background-color: #f1f1f1; } article .table-cell { flex: 1; } @media (max-width: 768px) { article .table-row { flex-direction: column; border: 1px solid #ccc; margin-bottom: 10px; padding: 0; gap: 0px; border-bottom: 0; } article .table-row.header { display: none; } article .table-cell { display: flex; padding: 10px; border-bottom: 1px solid #ccc; font-size: 14px; flex-direction: column; } article .table-cell:before { content: attr(data-label) ": "; font-weight: bold; width: 120px; min-width: 120px; margin-right: 10px; } article .table-placeholder{ box-shadow: none; } }

How do I reissue my SSL certificate


Use Reissue when you need a replacement SSL/TLS certificate under an eligible NiceNIC certificate order―for example, after losing the matching private key or correcting certificate details. If you are only moving hosts and still control the matching private key, reinstalling the existing unexpired certificate may be sufficient.


Reissue through your NiceNIC SSL order

  1. Sign in to NiceNIC and locate the exact SSL certificate order. Record the covered hostnames, current certificate expiration and paid service term.

  1. Open the available Reissue or certificate-management action for that order. If you cannot see such a control, use the Human Support button on the article instead of purchasing a duplicate SSL product.
  2. Decide whether the current private key is safe. If lost or compromised, generate a new key and CSR. Never send the private key to NiceNIC, a certificate authority or a support agent.
  3. Verify the CSR's Subject Alternative Names (SANs) and submit it through the authorized reissue workflow.
  4. Complete the certificate authority's domain-control validation. OV/EV products may also require updated organization checks.
  5. Download the newly issued certificate plus the necessary intermediate certificates or chain.

  1. Install the replacement certificate on the actual TLS endpoint (hosting server, reverse proxy, CDN or load balancer) with the matching private key.
  2. Verify the deployed certificate's SANs, issuer chain and Not After date from outside your network. Check all relevant hostnames and server nodes before removing the old working deployment.

If the previous key was compromised, follow the certificate authority's revocation procedure for the affected certificate―not merely a local file deletion.


Why the expiration date may not match your paid subscription

Since 15 March 2026, newly issued publicly trusted TLS server certificates have been limited to 200 days of validity under the CA/Browser Forum rules. A longer paid service term may require multiple certificate replacements. A reissue does not by itself extend the paid subscription.


Reissue troubleshooting

  • The server reports a key mismatch: the installed private key does not match the new certificate/CSR.
  • Validation is pending: check DNS/HTTP challenge data at the authoritative DNS provider or site, as instructed by the issuing CA.
  • The browser still shows the old certificate: inspect CDN edges, multiple web-server nodes, SNI and whether the service was reloaded.
  • No Reissue action appears: check the product's eligibility and send NiceNIC Support the SSL order number and non-sensitive status.

For when reissue is necessary rather than how, read Certificate reissue reasons explained.


How to decide whether to reuse or rotate the key

Reusing an existing private key may be technically possible in some issuance workflows, but generating a fresh key is generally preferable when the old key is lost, may have leaked, or cannot be securely transferred. Check the certificate authority's current product rules and your organization's key-management policy.

Example: You move a shop from one web server to another. If the server's key material cannot be securely transferred, generate a CSR on the new TLS endpoint and request a replacement certificate for the required names. Before cutting over, validate domain control, ensure the new cert covers both shop.example.com and any additional names, then check the public HTTPS response.


Reissue completion checklist

Layer
Confirmation
Certificate authority
Issuance completed; certificate not pending validation
Private key
Corresponds to the issued certificate
Server or CDN
New certificate and complete chain installed at every TLS endpoint
Public visitor test
Correct SANs, trusted chain and updated Not After
Security
If replacing a compromised key, revocation of the prior certificate is handled

A successful reissue in a registrar portal is not enough if the web server still presents the old certificate. Conversely, a certificate with a new Not After date does not prove the paid service has been renewed for another billing term.


Related NiceNIC Guides

]]> http://www.nicenic.com/support/doc.php?IDDoc=3904 How to Generate CSR Code? www.nicenic.com SSL Certificates http://www.nicenic.com/support/?IDCate=294 body { margin: 0; padding: 0; } article { width: 100%; max-width: 100%; margin: 0; padding: 0; box-sizing: border-box; font-family: "Montserrat", serif; color: #000; text-rendering: optimizeLegibility; -webkit-font-smoothing: antialiased; } article > * { width: 100%; font-size: 16px; line-height: 1.6; margin: 0; padding: 0; box-sizing: border-box; } article h2, article h3, article h4, article h5, article h6 { text-align: left; font-weight: bold; } article li{ list-style: inside; } article li > * { display: inline !important; margin: 0; font-size: 16px; } article p { padding: 0; width: 100%; } article .caps { font-variant: small-caps; letter-spacing: 0.05em; } article .responsive-table { width: 100%; margin: 20px 0; } article .table-placeholder{ box-shadow: 0 0 10px rgba(0, 0, 0, 0.1); } article .table-row { display: flex; border-bottom: 1px solid #ccc; padding: 10px; gap: 20px; box-sizing: border-box; } article .table-row:last-child { border-bottom: none; } article .table-row.header { font-weight: bold; background-color: #f1f1f1; } article .table-cell { flex: 1; } @media (max-width: 768px) { article .table-row { flex-direction: column; border: 1px solid #ccc; margin-bottom: 10px; padding: 0; gap: 0px; border-bottom: 0; } article .table-row.header { display: none; } article .table-cell { display: flex; padding: 10px; border-bottom: 1px solid #ccc; font-size: 14px; flex-direction: column; } article .table-cell:before { content: attr(data-label) ": "; font-weight: bold; width: 120px; min-width: 120px; margin-right: 10px; } article .table-placeholder{ box-shadow: none; } }

How to Generate CSR Code?


A Certificate Signing Request (CSR) supplies a certificate authority with your public key and the information needed for a TLS certificate. The corresponding private key stays on your server. Never paste the private key into a support ticket or CSR form.


Generate a CSR with OpenSSL

On a machine where OpenSSL is installed, the example below creates a new 2048-bit RSA private key and a CSR for www.example.com:

umask 077 # Linux/macOS: restrict permissions on new files

openssl req -new -newkey rsa:2048 -nodes 

-keyout www.example.com.key

-out www.example.com.csr

-subj "/CN=www.example.com"

-addext "subjectAltName=DNS:www.example.com,DNS:example.com"

Replace both hostnames with names you control. The SAN list is what modern TLS clients evaluate for hostname coverage; the Common Name alone is not enough for proper planning. If your CA or product requires a different key type or CSR format, follow that product's documentation.

On Windows or another platform without umask, apply equivalent filesystem permissions to the private key. Protect the .key file. The -nodes option creates an unencrypted private-key file, suitable only if you restrict filesystem access and manage secrets correctly. For more stringent security requirements, use protected keys or a hardware-backed key-management workflow.


Check the request before submitting

openssl req -in www.example.com.csr -noout -text -verify

Verify that the public key, subject and requested SANs are correct. The .csr file can be shared with the CA; the .key file must remain private.


Submit and install

Open your NiceNIC certificate order and use the supported activation or reissue flow to submit the CSR. Complete domain-control validation, wait for issuance, then install the issued certificate chain with the matching private key. After deployment, test HTTPS for every requested hostname.

If a control panel such as IIS or cPanel generates the CSR for you, use that panel's current instructions instead of creating an independent key and losing track of the matching keypair.


CSR example with SANs and key protection

For a new key pair on a modern OpenSSL installation, an authorized server administrator might use the following illustrative commands (change hostnames, storage paths and policy settings for production):

# Generate a private key; restrict the directory and file permissions.

openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out example.com.key

# CSR with both the base name and its www hostname.

openssl req -new -key example.com.key -out example.com.csr -subj "/CN=example.com" -addext "subjectAltName=DNS:example.com,DNS:www.example.com"

# Inspect the request, including the requested SANs.

openssl req -in example.com.csr -noout -text

Your actual CA may support EC keys or different issuance tooling; comply with its current algorithms and requirements. example.com.key is the private key: never paste it into a support ticket, email it or store it in a public repository. The .csr file is what you normally submit to the issuing authority.

Problem
Typical cause
Certificate covers example.com but not www
Missing SAN in the issued certificate
Certificate and key do not match
Key was regenerated after the CSR was created
CA cannot issue
Domain-control validation failed or applicant information is incomplete
CSR exposes an unnecessary identity field
Old command template inserted unreviewed subject details

A CSR is not proof that you own the domain. Domain-control validation must still be completed through the CA's approved method.


Related NiceNIC Guides

]]> http://www.nicenic.com/support/doc.php?IDDoc=3903 What is EV certificate ecommerce advantage www.nicenic.com SSL Certificates http://www.nicenic.com/support/?IDCate=294 body { margin: 0; padding: 0; } article { width: 100%; max-width: 100%; margin: 0; padding: 0; box-sizing: border-box; font-family: "Montserrat", serif; color: #000; text-rendering: optimizeLegibility; -webkit-font-smoothing: antialiased; } article > * { width: 100%; font-size: 16px; line-height: 1.6; margin: 0; padding: 0; box-sizing: border-box; } article h2, article h3, article h4, article h5, article h6 { text-align: left; font-weight: bold; } article li{ list-style: inside; } article li > * { display: inline !important; margin: 0; font-size: 16px; } article p { padding: 0; width: 100%; } article .caps { font-variant: small-caps; letter-spacing: 0.05em; } article .responsive-table { width: 100%; margin: 20px 0; } article .table-placeholder{ box-shadow: 0 0 10px rgba(0, 0, 0, 0.1); } article .table-row { display: flex; border-bottom: 1px solid #ccc; padding: 10px; gap: 20px; box-sizing: border-box; } article .table-row:last-child { border-bottom: none; } article .table-row.header { font-weight: bold; background-color: #f1f1f1; } article .table-cell { flex: 1; } @media (max-width: 768px) { article .table-row { flex-direction: column; border: 1px solid #ccc; margin-bottom: 10px; padding: 0; gap: 0px; border-bottom: 0; } article .table-row.header { display: none; } article .table-cell { display: flex; padding: 10px; border-bottom: 1px solid #ccc; font-size: 14px; flex-direction: column; } article .table-cell:before { content: attr(data-label) ": "; font-weight: bold; width: 120px; min-width: 120px; margin-right: 10px; } article .table-placeholder{ box-shadow: none; } }

What is EV certificate ecommerce advantage


An Extended Validation (EV) TLS certificate requires the issuing certificate authority to verify additional organizational identity information before issuance. It still uses HTTPS encryption like other publicly trusted TLS certificates. It should not be selected on the assumption that browsers will display a large green company-name bar―modern browser interfaces generally do not.


What EV checks add

Beyond verifying control of a domain, EV verification can involve checking the organization's legal existence, operating status, physical presence, contact information and authority of the requester, under the applicable EV Guidelines.

This can be useful for an established company that wants an additional CA-validated identity record. It does not prove that the business is honest, financially sound or immune to phishing, and it does not guarantee increased sales or search ranking.

EV, OV or DV?

Type
Core validation
Common fit
DV
Domain control
Blogs, apps, routine business websites
OV
Domain control plus organization information
Organizations needing verified identity details
EV
Domain control plus stricter documented organization vetting
Eligible registered organizations with an identity-verification requirement

All three can provide strong TLS transport protection when properly issued and deployed. Choose certificate coverage (single-name, wildcard or SAN) separately from identity-validation level; not every product supports every combination.

Before ordering EV

Confirm the legal entity is eligible, the registered name is accurate, authorized representatives can complete the CA's checks, and the application timeline suits the business. Compare cost, validation effort and ongoing replacement frequency―not just the certificate badge.

Since March 15, 2026, newly issued publicly trusted TLS server certificates have a maximum validity period of 200 days under the CA/Browser Forum rules. More frequent certificate replacement is distinct from renewed legal-entity checks, which follow separate reuse rules.

Related: How to Choose an SSL Certificate and the CA/Browser Forum EV Guidelines.


What extra value does EV provide for ecommerce?

EV (Extended Validation) requires the certificate authority to perform more extensive organization vetting than DV, including checks of the applicant's legal existence and relevant organizational information. This can help a buyer whose enterprise customers need documented legal-entity validation.

Validation type
Validates
Typical buyer
DV
Domain control
Blogs, online shops, APIs and most standard websites
OV
Domain control and organization identity under CA procedures
Corporate websites and business procurement
EV
Domain control plus more extensive legal-entity and authorization checks
Organizations with formal vetting or compliance expectations

Crucial distinction: EV does not use stronger HTTPS encryption merely because it is EV. Properly configured DV, OV and EV certificates can use comparable modern TLS cipher suites. Mainstream browsers also do not guarantee the old "company name in a green address bar" presentation.


A realistic ecommerce decision

A small store using a reputable payment processor may obtain satisfactory HTTPS protection from DV, as long as the certificate matches the hostname and the site itself is secure. A regulated enterprise might choose EV for its identity-review process or contractual reasons. In neither case does EV replace payment security controls, PCI obligations, anti-fraud processes or a sound refund policy. If your customers ask specifically for verified organizational identity, examine the CA's current OV/EV documentation and issuance time before ordering.


Related NiceNIC Guides

]]> http://www.nicenic.com/support/doc.php?IDDoc=3902 Certificate reissue reasons explained www.nicenic.com SSL Certificates http://www.nicenic.com/support/?IDCate=294 body { margin: 0; padding: 0; } article { width: 100%; max-width: 100%; margin: 0; padding: 0; box-sizing: border-box; font-family: "Montserrat", serif; color: #000; text-rendering: optimizeLegibility; -webkit-font-smoothing: antialiased; } article > * { width: 100%; font-size: 16px; line-height: 1.6; margin: 0; padding: 0; box-sizing: border-box; } article h2, article h3, article h4, article h5, article h6 { text-align: left; font-weight: bold; } article li{ list-style: inside; } article li > * { display: inline !important; margin: 0; font-size: 16px; } article p { padding: 0; width: 100%; } article .caps { font-variant: small-caps; letter-spacing: 0.05em; } article .responsive-table { width: 100%; margin: 20px 0; } article .table-placeholder{ box-shadow: 0 0 10px rgba(0, 0, 0, 0.1); } article .table-row { display: flex; border-bottom: 1px solid #ccc; padding: 10px; gap: 20px; box-sizing: border-box; } article .table-row:last-child { border-bottom: none; } article .table-row.header { font-weight: bold; background-color: #f1f1f1; } article .table-cell { flex: 1; } @media (max-width: 768px) { article .table-row { flex-direction: column; border: 1px solid #ccc; margin-bottom: 10px; padding: 0; gap: 0px; border-bottom: 0; } article .table-row.header { display: none; } article .table-cell { display: flex; padding: 10px; border-bottom: 1px solid #ccc; font-size: 14px; flex-direction: column; } article .table-cell:before { content: attr(data-label) ": "; font-weight: bold; width: 120px; min-width: 120px; margin-right: 10px; } article .table-placeholder{ box-shadow: none; } }

Certificate reissue reasons explained


A certificate reissue creates a new SSL/TLS certificate under an eligible existing service order. You may need one if the private key is lost or compromised, the CSR is wrong, the certificate's covered names must change, or the issued certificate can no longer be deployed correctly.


Which situations call for a reissue?

Situation
Reissue needed?
Why
Private key exposed or stolen
Yes: replace and revoke appropriately
A compromised key can no longer be trusted
Private key lost
Yes, if no secure copy exists
A certificate cannot be deployed without its matching key
Incorrect CSR or key mismatch
Usually
Issue a certificate matching a correct key pair
Moving the site to another server
Not always
You may securely migrate the certificate and matching private key
Adding another hostname
Depends on the product
Confirm permitted SAN changes or order a different certificate
Approaching certificate expiration
Replacement required
Choose the renewal/reissue route available for the current service

Reissue is not the same as renewing the service

A paid multi-year SSL service term (if offered) is not one certificate valid for multiple years. Under the CA/Browser Forum TLS Baseline Requirements, newly issued publicly trusted TLS server certificates have a maximum 200-day validity from 15 March 2026, with further reductions scheduled for later years.

Reissuing does not necessarily extend the service's paid term. The renewal date of the service order and the expiry date of the installed certificate must be monitored separately.


What to prepare before requesting a reissue

Identify the exact SSL order, hostnames, validation level (DV/OV/EV), server or CDN environment and reason for replacement. If the old key is compromised, generate a fresh key and CSR and follow revocation instructions. Keep the private key secure. Ensure you can complete the new domain-control validation.

For the actual step-by-step request and installation, see How do I reissue my SSL certificate.

After deployment, verify the certificate SAN, validity, trust chain and the certificate actually presented by every live HTTPS endpoint. Reissue alone does not update certificates already installed on web servers, CDN edges or load balancers.



Reissue versus renew versus revoke

Operation
Typical reason
Effect on existing certificate
Reissue / replacement
Key replacement, SAN or server change, certificate misconfiguration
A new certificate is issued under the service's applicable terms; does not necessarily extend the subscription
Renew service
Continue the paid SSL service beyond its paid term
Provides entitlement to continued certificate issuance as defined by the product
Revoke certificate
Key compromise, incorrect certificate or other CA-approved reason
CA marks the affected certificate invalid; deployments must stop relying on it


Example 1 ― compromised web-server key. If an attacker may have obtained example.com's TLS private key, generate a new key and CSR, obtain a replacement certificate, coordinate revocation of the exposed certificate and deploy the new one everywhere. Reinstalling the old certificate would not resolve key compromise.

Example 2 ― moving a site from Apache to a CDN. The CDN may need its own certificate/key management, but you do not automatically need to reissue if the existing certificate and private key remain usable in the approved configuration. Check who terminates TLS and whether a new key is required.

Example 3 ― adding shop.example.com. If the current certificate covers only example.com, issuing a replacement with the appropriate SAN set or obtaining another certificate may be needed. Merely changing DNS does not extend certificate hostname coverage.


Related NiceNIC Guides

]]> http://www.nicenic.com/support/doc.php?IDDoc=3901 How to Activate and Download an SSL Certificate www.nicenic.com SSL Certificates http://www.nicenic.com/support/?IDCate=294 How to Activate and Download an SSL Certificate


Thank you for purchasing SSL with NiceNIC.

How to activate and download SSL certificate SSL installation is now even easier with our SSL installation service.

After the SSL certificate on your domain name was activated, please find and add the DNS records to complete the verification:

My Account > My Products > SSL Certificates > Detail > ....





NiceNIC- DNS records

NiceNIC-DNS records

This step requires extra care:

Fill each piece of information in the DNS Authentication Information shown below into its corresponding DNS record one by one.

NiceNIC- CNAME record

After you complete the DNS record's verification, you can download the SSL files by the same approach:

My Account > My Products > SSL Certificates > Detail > Download certificate & Download private key




Still have problems?

- If your domain, server, or certificate details have changed, see Why You May Need to Reissue an SSL Certificate.

- If the current certificate cannot be used, follow How to Reissue an SSL Certificate.

- To prevent certificate expiration, read How to Renew an SSL Certificate.

If they didn't solve your issues, you can contact us here.

]]> http://www.nicenic.com/support/doc.php?IDDoc=3832 Common DNS Record Types: A, AAAA, CNAME, MX and TXT www.nicenic.com Business Email http://www.nicenic.com/support/?IDCate=290 body { margin: 0; padding: 0; } article { width: 100%; max-width: 100%; margin: 0; padding: 0; box-sizing: border-box; font-family: "Montserrat", serif; color: #000; text-rendering: optimizeLegibility; -webkit-font-smoothing: antialiased; } article > * { width: 100%; font-size: 16px; line-height: 1.6; margin: 0; padding: 0; box-sizing: border-box; } article h2, article h3, article h4, article h5, article h6 { text-align: left; font-weight: bold; } article li{ list-style: inside; } article li > * { display: inline !important; margin: 0; font-size: 16px; } article p { padding: 0; width: 100%; } article .caps { font-variant: small-caps; letter-spacing: 0.05em; } article .responsive-table { width: 100%; margin: 20px 0; } article .table-placeholder{ box-shadow: 0 0 10px rgba(0, 0, 0, 0.1); } article .table-row { display: flex; border-bottom: 1px solid #ccc; padding: 10px; gap: 20px; box-sizing: border-box; } article .table-row:last-child { border-bottom: none; } article .table-row.header { font-weight: bold; background-color: #f1f1f1; } article .table-cell { flex: 1; } @media (max-width: 768px) { article .table-row { flex-direction: column; border: 1px solid #ccc; margin-bottom: 10px; padding: 0; gap: 0px; border-bottom: 0; } article .table-row.header { display: none; } article .table-cell { display: flex; padding: 10px; border-bottom: 1px solid #ccc; font-size: 14px; flex-direction: column; } article .table-cell:before { content: attr(data-label) ": "; font-weight: bold; width: 120px; min-width: 120px; margin-right: 10px; } article .table-placeholder{ box-shadow: none; } }


Common DNS Record Types: A, AAAA, CNAME, MX and TXT


A domain uses several types of DNS records for different jobs. A and AAAA direct traffic to server IP addresses, CNAME aliases one hostname to another, MX routes incoming email, and TXT publishes text-based verification or policy information.



The five records, with examples

Record
What it does
Example host
Example value
A
Points a hostname to an IPv4 address
@
192.0.2.10
AAAA
Points a hostname to an IPv6 address
@
2001:db8::10
CNAME
Makes a hostname an alias of another hostname
www
example.com
MX
Specifies where incoming mail should be delivered
@
Priority 10, server mail.example.com
TXT
Holds provider verification strings and policies
@
v=spf1 -all (illustrative; not a production mail policy)

The IP addresses above are documentation-only addresses. Your hosting or mail provider must give you the real destination values.


Add or edit records at NiceNIC

  1. Find the authoritative nameservers for the domain. If DNS is managed by Cloudflare or another DNS provider, edit the zone there―not in an inactive NiceNIC zone.

  1. If NiceNIC hosts your DNS, sign in and open My Products > Domain > DNS Records for the correct domain.
  1. Choose the record type. Enter the host/name, destination/value, and any extra fields such as MX priority or TTL.

  1. Save, then look up the public DNS response. Examples: dig example.com A, dig example.com AAAA, dig www.example.com CNAME, dig example.com MX, and dig example.com TXT.
  2. Test the actual website or mailbox after the new records become visible.


Avoid the common conflicts

  • A CNAME must not coexist with other record data at the same DNS owner name. Many DNS panels therefore do not support a normal CNAME at the zone apex (@).
  • An MX record points to a hostname, not directly to an IP address. That mail-server hostname must resolve correctly.
  • Setting an MX record does not create a mailbox. You must configure mail service separately.
  • TXT can be used for SPF, DKIM, DMARC and provider verification, but those are distinct tasks with their own formatting requirements.
  • DNS changes can be cached until previous TTL values expire. A saved record is not proof that public resolvers see it yet.

For specific email-authentication policies, see What is SPF and How to Set Up SPF?.


Related NiceNIC Guides

]]> http://www.nicenic.com/support/doc.php?IDDoc=3913 Why need SSL Certificates www.nicenic.com SSL Certificates http://www.nicenic.com/support/?IDCate=294 body { margin: 0; padding: 0; } article { width: 100%; max-width: 100%; margin: 0; padding: 0; box-sizing: border-box; font-family: "Montserrat", serif; color: #000; text-rendering: optimizeLegibility; -webkit-font-smoothing: antialiased; } article > * { width: 100%; font-size: 16px; line-height: 1.6; margin: 0; padding: 0; box-sizing: border-box; } article h2, article h3, article h4, article h5, article h6 { text-align: left; font-weight: bold; } article li{ list-style: inside; } article li > * { display: inline !important; margin: 0; font-size: 16px; } article p { padding: 0; width: 100%; } article .caps { font-variant: small-caps; letter-spacing: 0.05em; } article .responsive-table { width: 100%; margin: 20px 0; } article .table-placeholder{ box-shadow: 0 0 10px rgba(0, 0, 0, 0.1); } article .table-row { display: flex; border-bottom: 1px solid #ccc; padding: 10px; gap: 20px; box-sizing: border-box; } article .table-row:last-child { border-bottom: none; } article .table-row.header { font-weight: bold; background-color: #f1f1f1; } article .table-cell { flex: 1; } @media (max-width: 768px) { article .table-row { flex-direction: column; border: 1px solid #ccc; margin-bottom: 10px; padding: 0; gap: 0px; border-bottom: 0; } article .table-row.header { display: none; } article .table-cell { display: flex; padding: 10px; border-bottom: 1px solid #ccc; font-size: 14px; flex-direction: column; } article .table-cell:before { content: attr(data-label) ": "; font-weight: bold; width: 120px; min-width: 120px; margin-right: 10px; } article .table-placeholder{ box-shadow: none; } }

Why need SSL Certificates


An SSL/TLS certificate lets browsers and applications establish HTTPS with your server. Today HTTPS is a normal requirement for professional sites, forms, account pages and APIs―not an optional extra reserved for ecommerce.


Why HTTPS matters to your visitors

Protection in transit. TLS encrypts the connection so that observers on the network cannot ordinarily read the page content or submitted form values.

Connection authentication. The browser verifies that the certificate is trusted and valid for the exact hostname. This reduces the risk of connecting to an impersonating endpoint.

Integrity. TLS helps prevent undetected modification of data while it crosses networks.


Where HTTPS is especially important

Use HTTPS for sign-in screens, payment or contact forms, dashboards, documentation, APIs and ordinary public pages. Modern browsers may mark unencrypted HTTP pages as insecure or restrict some browser features.


What a certificate cannot do

HTTPS does not remove malware, repair vulnerable website code, prevent stolen credentials or guarantee that a business is legitimate. A fraudulent site can also obtain a DV certificate. Combine TLS with software patching, account security, backups and phishing awareness.


Keep the certificate working

Select the right hostname coverage, install the proper chain and private key, redirect HTTP visitors safely to HTTPS, and monitor the actual certificate expiry date. Certificates issued under public trust rules from March 15, 2026 have a maximum validity period of 200 days―configure alerts or verified automation accordingly.

To compare coverage and validation levels, see How to Choose an SSL Certificate.


Before and after HTTPS: a concrete comparison

Visitor activity
Without correctly configured HTTPS
With correctly configured HTTPS
Entering a password
Network traffic may be readable or alterable in transit
TLS encrypts and protects it to the authenticated server
Submitting an enquiry form
Form data may be exposed in transit
Data in transit is protected, but server-side storage still needs security
Calling an API
Access tokens can be exposed over HTTP
TLS helps protect requests and responses
Browsing a public product page
Intermediaries may inject or modify content
TLS helps preserve response integrity

Important limitation: HTTPS cannot prevent a malicious website operator from misusing form data after it arrives, and it cannot stop phishing just because a site has a padlock. Even a site with a valid DV/OV/EV certificate must enforce secure passwords, software updates and access controls.

Business example: A small shop using a hosted payment provider should secure its own homepage, cart and checkout redirects with HTTPS, not rely only on the payment provider's certificate. Test the entire customer journey and eliminate mixed HTTP resources that trigger browser warnings.


Related NiceNIC Guides

]]> http://www.nicenic.com/support/doc.php?IDDoc=3911 Types of SSL Certificates www.nicenic.com SSL Certificates http://www.nicenic.com/support/?IDCate=294 body { margin: 0; padding: 0; } article { width: 100%; max-width: 100%; margin: 0; padding: 0; box-sizing: border-box; font-family: "Montserrat", serif; color: #000; text-rendering: optimizeLegibility; -webkit-font-smoothing: antialiased; } article > * { width: 100%; font-size: 16px; line-height: 1.6; margin: 0; padding: 0; box-sizing: border-box; } article h2, article h3, article h4, article h5, article h6 { text-align: left; font-weight: bold; } article li{ list-style: inside; } article li > * { display: inline !important; margin: 0; font-size: 16px; } article p { padding: 0; width: 100%; } article .caps { font-variant: small-caps; letter-spacing: 0.05em; } article .responsive-table { width: 100%; margin: 20px 0; } article .table-placeholder{ box-shadow: 0 0 10px rgba(0, 0, 0, 0.1); } article .table-row { display: flex; border-bottom: 1px solid #ccc; padding: 10px; gap: 20px; box-sizing: border-box; } article .table-row:last-child { border-bottom: none; } article .table-row.header { font-weight: bold; background-color: #f1f1f1; } article .table-cell { flex: 1; } @media (max-width: 768px) { article .table-row { flex-direction: column; border: 1px solid #ccc; margin-bottom: 10px; padding: 0; gap: 0px; border-bottom: 0; } article .table-row.header { display: none; } article .table-cell { display: flex; padding: 10px; border-bottom: 1px solid #ccc; font-size: 14px; flex-direction: column; } article .table-cell:before { content: attr(data-label) ": "; font-weight: bold; width: 120px; min-width: 120px; margin-right: 10px; } article .table-placeholder{ box-shadow: none; } }

Types of SSL Certificates


SSL certificates differ in validation level and hostname coverage. Compare both dimensions before purchasing; a certificate can have the right validation level but still fail to cover the required hostnames.


Validation Types

  • Domain Validation (DV)
  • Organization Validation (OV)
  • Extended Validation (EV)


Coverage Types

  • Single-domain certificates
  • Wildcard certificates
  • Multi-domain certificates


How to Decide

  1. List the exact domains and subdomains.
  2. Choose the required identity-validation level.
  3. Confirm server and platform compatibility.
  4. Check renewal and reissue procedures.


Frequently Asked Questions

How do I know the change worked?

Check the current status in your NiceNIC account, then test the service that depends on the certificate type. Do not rely only on the absence of an error message.

When should I contact NiceNIC Support?

Submit a ticket when the required control is unavailable, the status remains pending after the checks in this guide, or the issue depends on an account-specific order or registry decision.


Related NiceNIC Guides


If the issue continues after you complete these checks, submit a NiceNIC support ticket. Include the affected domain or product, the exact error message, the time of the issue and the troubleshooting already completed.

]]>