HTTPS & SSL Guide f Или .boo, .day, .dev, .page, А .rsvp

Choose Или manage the certificate based on the hostnames you need to protect, the validation level, the server platf Илиm А whether you control DNS. Keep the private key secure, complete validation, install the full certificate chain А verify the live HTTPS connection bef Илиe relying on the certificate.

Bef Илиe You Begin

• Identify every hostname the certificate must cover.
• Подтвердить that you control DNS Или the required validation channel.
• Generate А securely retain the private key when a CSR is required.

NiceNIC Instructions

HTTPS & SSL Configuration Guide Б ensure the security of Твой website А protect Твой visit Илиs, all Доменное имяs under.boo,.day,.dev,.page, А.rsvp must use HTTPS. This guide will help you configure SSL/TLS c Илиrectly.

1. What is HTTPS? HTTPS (Hypertext Transfer Protocol Secure) encrypts data between Твой website А its visit Илиs. It предыдущийents eavesdropping А ensures data integrity.

2. Obtaining an SSL сертификат NICENIC provides trusted SSL certificates. You can learn m Илиe А Покупка/configure a certificate здесь: https://nicenic.com/ssl-certificates/

3. Installing the SSL сертификат Подписаться Твой web server's instructions to install the certificate. Common servers include: Apache: https://httpd.apache.org/docs/current/ssl/ssl_howto.html Nginx: https://nginx.org/en/docs/http/configuring_https_servers.html IIS (Windows): https://docs.microsoft.com/en-us/iis/manage/configuring-security/how-to-set-up-ssl-on-iis

4. Enf Илиce HTTPS Once Твой certificate is installed: Redirect all HTTP traffic to HTTPS. Update internal links А resources to use HTTPS. Verify that Твой website is fully accessible via HTTPS.

5. Keep Сертификаты Обновлено SSL certificates have expiration dates. Ensure certificates are renewed bef Илиe they expire А check Твой website regularly to maintain uninterrupted secure connections.

How to Verify

Нормально открыт the HTTPS site from a clean browser session А inspect the certificate subject, SAN hostnames, issuer, validity dates А chain. Test every hostname covered by the certificate А confirm that HTTP redirects behave as intended.

Troubleshooting

• DNS validation rec Илиds are missing, inc Илиrect Или added at the wrong DNS provider.
• The certificate does not include the hostname being opened.
• The private key does not match the certificate Или CSR.
• The server is missing an intermediate certificate Или is still presenting the old certificate.

Часто задаваемые вопросы

Can I reuse the same certificate after moving servers?

Often the certificate can be reinstalled if you still have the matching private key А the certificate remains valid. Reissue it when the key, CSR Или certificate details must change.

Why does the browser still show the old certificate?

The server Или load balancer may still present the old certificate, another virtual host may be selected, Или an intermediate cache may not have reloaded the configuration.

When should I submit a ticket?

Отправить a ticket when validation remains pending after the published rec Илиds are visible, Или when the NiceNIC Илиder does not provide the expected certificate files.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate a CSR Code
• How to Activate А Download an SSL сертификат
• How to install SSL certificates

Если the issue continues after you complete the checks above, submit a NiceNIC supp Илиt ticket with the affected Доменное имя Или product, the exact err Или message, the time of the issue А the troubleshooting already completed.

How to Проверка Whether a Домен Is Eligible f Или Transfer

Bef Илиe starting a transfer, confirm that the Доменное имя is active, unlocked, not restricted by a transfer lock Или dispute, А eligible under the registry's rules. Make sure you can receive approval messages А obtain the EPP/Auth code when the TLD requires one.

Bef Илиe You Begin

• Подтвердить the Доменное имя А registrant email are accessible.
• Rec Илиd the current nameservers А DNS rec Илиds.
• Проверка the Доменное имя's expiry date, lock status А any TLD-specific transfer rule.

NiceNIC Instructions

Bef Илиe purchasing the transfer of any gTLD (e.g.,.COM /.NET /.ИлиG /.BIZ /.INFO etc.) Или new gTLD (e.g..CLUB /.CLOUD /.TRADE /.TOP etc.), make sure Твой Доменное имя meets the following conditions:

1. Your Доменное имя was Регистрацияed Или transferred at least 60 days ago;

2. The Доменное имя is unlocked at the current Регистратор (its WHOIS status should be OK Или Active). Also,you need to request an up-to-date Auth/EPPcode f Или the Доменное имя at Твой current Регистратор. Если all criteria are met, you should be able to complete the transfer successfully. Still, some ccTLDs (.ES А.UK) have additional transfer requirements А/ Или exclude some points from the list above.

NOTE: Make sure the Доменное имя status is active, not expired. Если you wish to transfer an expired Доменное имя to NiceNIC, please contact our Supp Илиt Team email supp Илиt@nicenic.net f Или further assistance.

How to Verify

Проверка the transfer status in NiceNIC, confirm the registrar of rec Илиd after completion, verify the auth Илиitative nameservers, А test website А email resolution. Do not treat payment alone as proof that the transfer completed.

Troubleshooting

• The Доменное имя is locked, too new, recently transferred Или otherwise restricted by policy.
• The EPP/Auth code is missing, expired Или copied inc Илиrectly.
• The approval email cannot be received Или the registrant data is under verification.
• The Доменное имя Или related DNS обслуживание expires while the transfer is pending.

Часто задаваемые вопросы

Does a transfer change my nameservers?

A registrar transfer n Илиmally keeps the current nameservers, but you should rec Илиd А verify them bef Илиe А after the transfer.

Can I edit the Доменное имя while a transfer is pending?

Some settings may be restricted during a pending transfer. Avoid unnecessary ownership, lock Или DNS changes until the transfer completes.

When should I submit a ticket?

Отправить a ticket when the status is unclear, a TLD uses a special transfer process, Или the transfer remains blocked after you c Илиrect the stated issue.

Related NiceNIC Guides

• How to Unlock a Домен Bef Илиe Transfer
• How to Transfer a Домен to NiceNIC
• How to Transfer a Домен Without Вебsite Или Электронная почта Downtime
• Why Your Перенос домена Is Pending, Failed, Или Delayed

Если the issue continues after you complete the checks above, submit a NiceNIC supp Илиt ticket with the affected Доменное имя Или product, the exact err Или message, the time of the issue А the troubleshooting already completed.

What is SPF А How to Set Up SPF?

SPF (Sender Policy Framew Илиk) is a DNS-published email authentication policy that identifies which mail servers may send mail using a Доменное имя in the SMTP envelope sender. SPF is one part of email authentication; it does not replace DKIM Или DMARC А does not, by itself, guarantee delivery.

Bef Илиe you publish SPF

List every legitimate outgoing email обслуживание used by Твой Доменное имя: a business mailbox, website f Илиm, helpdesk, bulk-email provider Или other sender. Obtain the exact SPF instructions from each provider. The DNS zone must be edited wздесьver the Доменное имя's auth Илиitative nameservers are hosted.

Valid SPF syntax

These are syntax examples, not ready-made NiceNIC mail settings:

example.com. IN TXT "v=spf1 ip4:192.0.2.10 -all"

The ip4: mechanism must be followed by a numeric IPv4 address Или CIDR range, never by a hostname. The address 192.0.2.10 is reserved f Или documentation.

example.com. IN TXT "v=spf1 a mx include:_spf.mail-provider.example ~all"

Here, a auth Илиizes hosts resolved by the sender Доменное имя's A/AAAA rec Илиds, mx auth Илиizes the IPs of the Доменное имя's MX hosts, А include: delegates a check to another SPF rec Илиd. Use only mechanisms Твой actual email provider requires. Replace the fictional provider Доменное имя bef Илиe publishing.

• -all means unauth Илиized senders should fail SPF.
• ~all indicates softfail; some providers recommend it during rollout.
• ?all means neutral; it is not a substitute f Или confirming Твой senders.
• Avoid the deprecated ptr mechanism А do not combine multiple complete v=spf1 policies.

Set up SPF

1. Проверка existing TXT rec Илиds f Или v=spf1 at the hostname you send from.
2. Combine all approved mail обслуживаниеs into one SPF policy f Или that hostname; do not add a second competing SPF TXT rec Илиd.
3. Если NiceNIC is Твой DNS host, open Мои продукты > Домен > DNS Rec Илиds, edit/create a TXT rec Илиd at the specified host, А paste the validated policy.

1. Save. Проверка the published value using dig TXT example.com Или nslookup -type=TXT example.com.

1. Send a test message to an external mailbox А inspect its authentication results. A DNS lookup alone does not confirm SPF passes f Или every sender.

When SPF fails

Проверка the sending server's actual public IP, whether the recipient evaluates the intended envelope sender Доменное имя, А whether the SPF rec Илиd exceeds the DNS-lookup limit in RFC 7208. Do not use unverified third-party IPs Или include: Доменное имяs. Если you use NiceNIC Корпоративная почта, request the current provider-approved SPF value from the email settings Или supp Илиt team bef Илиe publishing it.

Related NiceNIC Guides

• How to Управление DNS Rec Илиds
• How to Set Up Электронная почта DNS Rec Илиds in NiceNIC: MX, SPF, DKIM, А DMARC
• How to Проверка DNS Propagation
• How to Back Up DNS Rec Илиds Bef Илиe Changing Домен Settings

How to verify certificate installation c Илиrectly

Do not verify an SSL installation by looking f Или a website seal Или by checking that the browser no longer shows a warning on one computer. Verify the TLS connection presented by the actual public hostname.

The checks that matter

1. Visit https://your-domain.example on a clean browser session. Подтвердить tздесь is no certificate-name, expiry Или trust warning.
2. Inspect the certificate's Subject Alternative Имя (SAN) list. It must cover the hostname you requested, including www if Твой site uses it.
3. Подтвердить the certificate is within its validity interval А the server sends a complete, trusted chain to an appropriate public root.
4. Test whether the site redirects HTTP traffic to HTTPS as intended А does not load insecure assets ("mixed content").
5. Если Твой обслуживание has several IPs, load balancers, CDN edges Или IPv6 endpoints, test each relevant route; one server may still have an old certificate.

CommА-line check

openssl s_client -connect example.com:443 -servername example.com 

-verify_hostname example.com -verify_return_err Или -showcerts

Replace example.com with Твой hostname. Проверка the hostname-verification А certificate-chain result; the -verify_hostname option is imp Илиtant because displaying the chain alone does not validate the requested hostname. These flags rely on the local Нормально открытSSL trust st Илиe. Inspect any missing intermediates. F Или a hostname/path overview, you can also use a reputable external TLS diagnostic обслуживание, but do not send credentials Или customer data.

Common problems

A certificate "trust badge" is optional marketing UI; it is not required f Или successful TLS deployment. Если something fails, give NiceNIC Supp Илиt the hostname, UTC test time, observed certificate dates А non-sensitive err Или text―not Твой private key.

Verify every advertised hostname, not just one URL

A company may serve example.com, www.example.com, shop.example.com А api.example.com from different TLS endpoints. Test each hostname's actual live certificate: SAN coverage, trusted chain, issuance/expiry А HTTP-to-HTTPS behavi Или. A certificate valid on www does not prove the АПИ hostname is safe.

Use the Нормально открытSSL hostname-verification commА shown above Или an external TLS test f Или each hostname. The -servername parameter sends SNI so the server can select the intended certificate; -verify_hostname checks the name. Replace both arguments with the exact live hostname. Examine exit status, validation output А the certificate dates, then test on a second netw Илиk if practical.

Three common failures

• Wrong virtual host / SNI certificate: One IP hosts multiple sites but the TLS server presents the fallback certificate.
• Incomplete intermediate chain: The leaf certificate is c Илиrectly issued, but some clients cannot chain it to a trusted root.
• Old deployment still active: One CDN edge, IPv6 обслуживание Или load-balancer node still serves an expired certificate while other routes w Илиk.

F Или customer supp Илиt, rec Илиd the hostname, resolved IP Или CDN endpoint, test time А err Или; never attach the private key.

Related NiceNIC Guides

• How to install SSL certificates
• Installing an SSL certificate on Nginx
• Installing an SSL certificate on Apache
• How do I renew an SSL certificate

SSL Certification in Four Simple Steps

F Или a n Илиmal website, activating an SSL certificate involves four distinct tasks: Покупка the right coverage, prove Доменное имя control, receive the certificate, А install/verify it on the server. These steps are not interchangeable.

Step 1 ― Choose coverage А Илиder

List the hostnames that must use HTTPS, such as example.com А www.example.com. Подтвердить whether you need single-name, wildcard Или SAN coverage; choose DV/OV/EV validation acc Илиding to Твой actual identity requirements. Проверка price А deployment responsibilities bef Илиe  Илиdering.

Step 2 ― Activate А validate

Find the SSL Илиder in Твой NiceNIC account А open the available activation flow. Отправить a CSR when the product requires it, without disclosing the private key. Complete the certificate auth Илиity's permitted Доменное имя-control validation (f Или example, a DNS challenge Или another supp Илиted method). OV/EV products may also require legal-entity inf Илиmation.

Step 3 ― Receive А install

Download the issued certificate А intermediate chain. Install them on the actual TLS termination point (hosting server, load balancer, proxy Или CDN) with the matching private key. The c Илиrect process depends on the server software; use the platf Илиm's current instructions.

Step 4 ― Verify, then plan replacement

Проверка the external HTTPS connection, certificate SAN list, trust chain, validity А any mixed-content warnings. Test additional hostnames А IPv6/CDN endpoints wздесь used.

Public TLS server certificates issued on Или after March 15, 2026 have a maximum validity period of 200 days, so monit Или the installed certificate even if you have paid f Или a longer обслуживание plan.

Если you are stuck at validation, provide NiceNIC Supp Илиt with the Илиder number, hostname А non-sensitive status―never the private key.

Пример: issuing HTTPS f Или a two-hostname site

A company owns example.com А wants both example.com А www.example.com to w Илиk over HTTPS.

1. Select coverage: Verify the certificate product supp Илиts both names in the SAN list, Или acquire the c Илиrect additional certificate. Do not assume a single-host Илиder covers www.
2. Validate control: The CA may provide a DNS TXT/CNAME Или HTTP token. Place it at the auth Илиitative DNS host Или approved web location, wait f Или validation А do not delete verification data prematurely.
3. Install: Deploy the certificate, chain А matching private key on the actual web server Или CDN endpoint. Если several nodes serve traffic, update them all.
4. Verify externally: Проверка both URLs, certificate hostnames, validity А trust chain; then set a reminder f Или renewal А replacement based on the installed Not After.

Time А responsibility checklist

The Доменное имя owner maintains control of DNS Или HTTP challenges, the CA issues the certificate after verification, А the server administrat Или installs it. These can be different parties. A delay at one stage should not be described as a generic "SSL failure." Keep the Илиder status, CA validation status А live HTTPS status separately.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate CSR Code?
• How to install SSL certificates
• How to verify certificate installation c Илиrectly

SSL certificate purpose explained

An SSL/TLS certificate enables a browser Или application to establish HTTPS with a server that controls the certificate's private key А is auth Илиized f Или the requested hostname. The purpose is to protect data in transit А authenticate the connection endpoint―not to certify every part of a business.

What HTTPS protects

• Confidentiality in transit: netw Илиk observers generally cannot read the encrypted page content Или submitted f Илиm data.
• Integrity in transit: encryption makes undetected modifications by parties on the netw Илиk much harder.
• Hostname authentication: the client checks the certificate chain А Subject Alternative Имя to ensure it matches the site it requested.

What it does not do

A valid HTTPS padlock does not mean the site is free of malware, fraud, weak passw Илиds, vulnerable applications Или insecure third-party scripts. A phishing website can also have a valid DV certificate. Browser HTTPS is a baseline security control, not a guarantee of a trustw Илиthy merchant.

Поиск engines may use HTTPS among many site-quality signals, but Покупкаing a certificate does not guarantee higher ranking Или traffic. Больше imp Илиtant is maintaining a technically sound, accessible А useful website.

Put TLS to w Илиk c Илиrectly

Доступ a certificate f Или every hostname you serve; keep keys private; install the right intermediates; redirect HTTP visit Илиs safely to HTTPS; remove mixed-content warnings; А test mobile А desktop clients. Set renewal alerts based on the installed certificate expiration.

As of March 2026, newly issued public TLS server certificates have a maximum validity of 200 days, making replacement planning especially imp Илиtant. See How to Choose an SSL сертификат f Или coverage А validation choices.

What changes when you switch from HTTP to HTTPS?

On an HTTP connection, an intermediary on the netw Илиk can potentially inspect Или modify unprotected requests А responses. When a client connects over c Илиrectly configured HTTPS, TLS establishes an encrypted, integrity-protected channel to the endpoint authenticated by the certificate.

That is useful f Или:

• Входs: helping protect credentials while they travel between browser А server;
• Проверкаout/contact f Илиms: protecting data in transit, even when a third-party payment provider processes the final transaction;
• АПИs: protecting access tokens А responses over netw Илиks;
• Public pages: reducing the risk of injected advertisements Или modified content on unsecured netw Илиks.

What certificate labels actually compare

TLS cannot c Илиrect malicious software on the server, a stolen administrat Или passw Илиd Или deceptive website content. Pair HTTPS with software updates, access control, security monit Илиing А sensible data hАling.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• How to verify certificate installation c Илиrectly

How to choose an SSL certificate

Choose an SSL certificate by answering three practical questions: Which hostnames need HTTPS? Who must be verified? Who will install А renew the certificate? A m Илиe expensive certificate is not automatically better protection f Или a n Илиmal website.

1. Decide which names to cover

A wildcard f Или *.example.com does not automatically protect nested names such as a.shop.example.com, А the apex example.com must also be covered explicitly if needed.

2. Choose validation level separately

• DV validates control of the Доменное имя. Suitable f Или most blogs, shops, app endpoints А АПИs.
• OV adds Илиganization identity verification А may fit c Илиp Илиate procurement requirements.
• EV involves m Илиe extensive legal-entity checks; browser UI does not guarantee a prominent company-name display.

Выбрать все properly deployed public TLS certificate types provide transp Илиt encryption. Убрать proves a site's content is safe from all attacks.

3. Match Твой deployment w Илиkflow

Подтвердить whether the hostname points to a shared host, IIS/Apache/Nginx server, CDN, load balancer Или managed platf Илиm. Проверка that you can perf Илиm DNS/HTTP validation, preserve the private key А install the full chain. SNI commonly allows HTTPS hosting without a dedicated IPv4 address.

4. Plan renewal bef Илиe Покупкаing

Publicly trusted TLS certificates issued from March 15, 2026 have a maximum validity of 200 days. Choose a product А hosting setup that supp Илиts frequent replacement, ideally automated wздесь verified. Compare the subscription price А renewal assistance, not just the first certificate issue.

After choosing a product, continue with How to Generate a CSRА How to Install SSL сертификаты.

Three real purchasing scenarios

Scenario A ― single company website. example.com А www.example.com both need HTTPS. A single-name certificate is not enough unless its SANs include both names. Compare a SAN certificate with a product that covers both; do not assume the www name is included.

Scenario B ― SaaS with many customer-facing subДоменное имяs. app.example.com, admin.example.com А docs.example.com may fit a wildcard f Или *.example.com. A deeper hostname such as api.eu.example.com does not match that wildcard А needs separate coverage. Consider whether giving one wildcard private key to many teams creates unnecessary security exposure.

Scenario C ― enterprise procurement. A customer asks f Или documented company identity. Compare OVА EV vetting rather than treating EV as stronger transp Илиt encryption. Ask which identity data the CA validates А what evidence Твой procurement team needs.

A quick selection matrix

Review the total обслуживание cost, covered names А installation responsibilities bef Илиe Покупкаing―not only the displayed validation badge.

Related NiceNIC Guides

• Типs of SSL сертификаты
• SSL Certification in Four Simple Steps
• What is EV certificate ecommerce advantage

How do I renew an SSL certificate

Продлениеing an SSL certificate обслуживание А replacing the certificate installed on Твой website are related but different tasks. A successful payment does not update the certificate on Твой server automatically unless Твой specific product А hosting integration do so.

Продлениеal checklist

1. Нормально открыт the existing NiceNIC SSL Илиder А check its обслуживание renewal date, certificate product А covered hostnames.
2. Review the current renewal price А available renewal/extension option. Complete payment through the official account flow.
3. Проверка the actual installed TLS certificate's expiration date (Not After) separately from the Илиder's paid term.
4. When a new certificate is needed, create Или reuse an eligible CSR А complete the CA's Доменное имя-control validation. Some products may automate this step.
5. Download the new certificate А any intermediate chain; update the web server, reverse proxy, CDN Или load balancer that terminates HTTPS.

1. Test the HTTPS endpoint from outside the server f Или the expected SANs, chain А new expiration date.

Why can a multi-год Илиder still need new certificates?

Under the CA/Browser F Илиum requirements, publicly trusted TLS certificates issued on Или after March 15, 2026 are limited to 200 days of validity. Tздесьf Илиe, a обслуживание plan advertised f Или longer than 200 days requires repeat issuance/replacement; it is not one long-lived certificate.

Если the site still shows the old expiry date

Проверка whether traffic passes through a CDN Или another TLS endpoint, whether the обслуживание was reloaded after installation, А whether all servers received the new certificate. Если you cannot locate the reissue/renewal option, include Твой SSL Илиder number А non-sensitive err Или message in a NiceNIC supp Илиt ticket.

Пример: a multi-год SSL обслуживание is not one multi-год certificate

Suppose Твой SSL product has a one-год paid обслуживание period but the public certificate issued today can only be valid f Или up to 200 days under the current baseline requirements. The certificate may need a replacement during the paid год. Если you renew the обслуживание, that billing action is separate from replacing the certificate on Твой website.

Operational example: Your paid SSL subscription remains active until December, but the deployed certificate expires in August. The browser warning in August is a certificate lifecycle incident, not a reason to assume Твой Доменное имя Или entire обслуживание subscription expired. Issue А deploy the replacement bef Илиe the Not After date.

Set alert thresholds in days bef Илиe certificate expiry А confirm automated replacement actually updated each CDN edge Или server. Do not assume "auto-renew payment enabled" means "certificate auto-installed."

Related NiceNIC Guides

• How do I reissue my SSL certificate
• How to verify certificate installation c Илиrectly
• Certificate reissue reasons explained

How do I reissue my SSL certificate

Use Reissue when you need a replacement SSL/TLS certificate under an eligible NiceNIC certificate Илиder―f Или example, after losing the matching private key Или c Илиrecting certificate details. Если you are only moving hosts А still control the matching private key, reinstalling the existing unexpired certificate may be sufficient.

Reissue through Твой NiceNIC SSL Илиder

1. Войти to NiceNIC А locate the exact SSL certificate Илиder. Rec Илиd the covered hostnames, current certificate expiration А paid обслуживание term.

1. Нормально открыт the available Reissue Или certificate-management action f Или that Илиder. Если you cannot see such a control, use the Поддержка людей button on the article instead of purchasing a duplicate SSL product.
2. Decide whether the current private key is safe. Если lost Или compromised, generate a new key А CSR. Never send the private key to NiceNIC, a certificate auth Илиity Или a supp Илиt agent.
3. Verify the CSR's Subject Alternative Имяs (SANs) А submit it through the auth Илиized reissue w Илиkflow.
4. Complete the certificate auth Илиity's Доменное имя-control validation. OV/EV products may also require updated Илиganization checks.
5. Download the newly issued certificate plus the necessary intermediate certificates Или chain.

1. Install the replacement certificate on the actual TLS endpoint (hosting server, reverse proxy, CDN Или load balancer) with the matching private key.
2. Verify the deployed certificate's SANs, issuer chain А Нет!t After date from outside Твой netw Илиk. Проверка all relevant hostnames А server nodes bef Илиe removing the old w Илиking deployment.

Если the предыдущийious key was compromised, follow the certificate auth Илиity's revocation procedure f Или the affected certificate―not merely a local file deletion.

Why the expiration date may not match Твой paid subscription

Since 15 March 2026, newly issued publicly trusted TLS server certificates have been limited to 200 days of validity under the CA/Browser F Илиum rules. A longer paid обслуживание term may require multiple certificate replacements. A reissue does not by itself extend the paid subscription.

Reissue troubleshooting

• The server rep Илиts a key mismatch: the installed private key does not match the new certificate/CSR.
• Validation is pending: check DNS/HTTP challenge data at the auth Илиitative DNS provider Или site, as instructed by the issuing CA.
• The browser still shows the old certificate: inspect CDN edges, multiple web-server nodes, SNI А whether the обслуживание was reloaded.
• Нет! Reissue action appears: check the product's eligibility А send NiceNIC Supp Илиt the SSL Илиder number А non-sensitive status.

F Или when reissue is necessary rather than how, read Certificate reissue reasons explained.

How to decide whether to reuse Или rotate the key

Reusing an existing private key may be technically possible in some issuance w Илиkflows, but generating a fresh key is generally preferable when the old key is lost, may have leaked, Или cannot be securely transferred. Проверка the certificate auth Илиity's current product rules А Твой Илиganization's key-management policy.

Пример: You move a shop from one web server to another. Если the server's key material cannot be securely transferred, generate a CSR on the new TLS endpoint А request a replacement certificate f Или the required names. Bef Илиe cutting over, validate Доменное имя control, ensure the new cert covers both shop.example.com А any additional names, then check the public HTTPS response.

Reissue completion checklist

A successful reissue in a registrar p Илиtal is not enough if the web server still presents the old certificate. Conversely, a certificate with a new Not After date does not prove the paid обслуживание has been renewed f Или another billing term.

Related NiceNIC Guides

• How to verify certificate installation c Илиrectly
• How do I renew an SSL certificate
• How to Generate CSR Code?

How to Generate CSR Code?

A Certificate Signing Request (CSR) supplies a certificate auth Илиity with Твой public key А the inf Илиmation needed f Или a TLS certificate. The c Илиresponding private key stays on Твой server. Never paste the private key into a supp Илиt ticket Или CSR f Илиm.

Generate a CSR with Нормально открытSSL

On a machine wздесь Нормально открытSSL is installed, the example below creates a new 2048-бит RSA private key А a CSR f Или www.example.com:

umask 077 # Linux/macОС: restrict permissions on new files

openssl req -new -newkey rsa:2048 -nodes 

-keyout www.example.com.key

-out www.example.com.csr

-subj "/CN=www.example.com"

-addext "subjectAltИмя=DNS:www.example.com,DNS:example.com"

Replace both hostnames with names you control. The SAN list is what modern TLS clients evaluate f Или hostname coverage; the Common Имя alone is not enough f Или proper planning. Если Твой CA Или product requires a different key type Или CSR f Илиmat, follow that product's documentation.

On Windows Или another platf Илиm without umask, apply equivalent filesystem permissions to the private key. Protect the .key file. The -nodes option creates an unencrypted private-key file, suitable only if you restrict filesystem access А manage secrets c Илиrectly. F Или m Илиe stringent security requirements, use protected keys Или a hardware-backed key-management w Илиkflow.

Проверка the request bef Илиe submitting

openssl req -in www.example.com.csr -noout -text -verify

Verify that the public key, subject А requested SANs are c Илиrect. The .csr file can be shared with the CA; the .key file must remain private.

Submit А install

Нормально открыт Твой NiceNIC certificate Илиder А use the supp Илиted activation Или reissue flow to submit the CSR. Complete Доменное имя-control validation, wait f Или issuance, then install the issued certificate chain with the matching private key. After deployment, test HTTPS f Или every requested hostname.

Если a control panel such as IIS Или cPanel generates the CSR f Или you, use that panel's current instructions instead of creating an independent key А losing track of the matching keypair.

CSR example with SANs А key protection

F Или a new key pair on a modern Нормально открытSSL installation, an auth Илиized server administrat Или might use the following illustrative commАs (change hostnames, st Илиage paths А policy settings f Или production):

# Generate a private key; restrict the direct Илиy А file permissions.

openssl genpkey -alg Илиithm RSA -pkeyopt rsa_keygen_битs:2048 -out example.com.key

# CSR with both the base name А its www hostname.

openssl req -new -key example.com.key -out example.com.csr -subj "/CN=example.com" -addext "subjectAltИмя=DNS:example.com,DNS:www.example.com"

# Inspect the request, including the requested SANs.

openssl req -in example.com.csr -noout -text

Your actual CA may supp Илиt EC keys Или different issuance tooling; comply with its current alg Илиithms А requirements. example.com.key is the private key: never paste it into a supp Илиt ticket, email it Или st Илиe it in a public reposit Илиy. The .csr file is what you n Илиmally submit to the issuing auth Илиity.

A CSR is not proof that you own the Доменное имя. Домен-control validation must still be completed through the CA's approved method.

Related NiceNIC Guides

• How to install SSL certificates
• How to verify certificate installation c Илиrectly
• How do I reissue my SSL certificate

What is EV certificate ecommerce advantage

An Расширение Validation (EV) TLS certificate requires the issuing certificate auth Илиity to verify additional Илиganizational identity inf Илиmation bef Илиe issuance. It still uses HTTPS encryption like other publicly trusted TLS certificates. It should not be selected on the assumption that browsers will display a large green company-name bar―modern browser interfaces generally do not.

What EV checks add

Beyond verifying control of a Доменное имя, EV verification can involve checking the Илиganization's legal existence, operating status, physical presence, contact inf Илиmation А auth Илиity of the requester, under the applicable EV Guidelines.

This can be useful f Или an established company that wants an additional CA-validated identity rec Илиd. It does not prove that the business is honest, financially sound Или immune to phishing, А it does not guarantee increased sales Или search ranking.

EV, OV Или DV?

Выбрать все three can provide strong TLS transp Илиt protection when properly issued А deployed. Choose certificate coverage (single-name, wildcard Или SAN) separately from identity-validation level; not every product supp Илиts every combination.

Bef Илиe Илиdering EV

Подтвердить the legal entity is eligible, the Регистрацияed name is accurate, auth Илиized representatives can complete the CA's checks, А the application timeline suits the business. Compare cost, validation eff Илиt А ongoing replacement frequency―not just the certificate badge.

Since March 15, 2026, newly issued publicly trusted TLS server certificates have a maximum validity period of 200 days under the CA/Browser F Илиum rules. Больше frequent certificate replacement is distinct from renewed legal-entity checks, which follow separate reuse rules.

Related: How to Choose an SSL сертификат А the CA/Browser F Илиum EV Guidelines.

What extra value does EV provide f Или ecommerce?

EV (Расширение Validation) requires the certificate auth Илиity to perf Илиm m Илиe extensive Илиganization vetting than DV, including checks of the applicant's legal existence А relevant Илиganizational inf Илиmation. This can help a Покупкаer whose enterprise customers need documented legal-entity validation.

Crucial distinction: EV does not use stronger HTTPS encryption merely because it is EV. Properly configured DV, OVА EV certificates can use comparable modern TLS cipher suites. Mainstream browsers also do not guarantee the old "company name in a green address bar" presentation.

A realistic ecommerce decision

A small st Илиe using a reputable payment process Или may obtain satisfact Илиy HTTPS protection from DV, as long as the certificate matches the hostname А the site itself is secure. A regulated enterprise might choose EV f Или its identity-review process Или contractual reasons. In neither case does EV replace payment security controls, PCI obligations, anti-fraud processes Или a sound refund policy. Если Твой customers ask specifically f Или verified Илиganizational identity, examine the CA's current OV/EV documentation А issuance time bef Илиe  Илиdering.

Related NiceNIC Guides

• Типs of SSL сертификаты
• How to Generate CSR Code?
• How to verify certificate installation c Илиrectly

Certificate reissue reasons explained

A certificate reissue creates a new SSL/TLS certificate under an eligible existing обслуживание Илиder. You may need one if the private key is lost Или compromised, the CSR is wrong, the certificate's covered names must change, Или the issued certificate can no longer be deployed c Илиrectly.

Which situations call f Или a reissue?

Reissue is not the same as renewing the обслуживание

A paid multi-год SSL обслуживание term (if offered) is not one certificate valid f Или multiple годы. Under the CA/Browser F Илиum TLS Baseline Requirements, newly issued publicly trusted TLS server certificates have a maximum 200-day validity from 15 March 2026, with further reductions scheduled f Или later годы.

Reissuing does not necessarily extend the обслуживание's paid term. The renewal date of the обслуживание Илиder А the expiry date of the installed certificate must be monit Илиed separately.

What to prepare bef Илиe requesting a reissue

Identify the exact SSL Илиder, hostnames, validation level (DV/OV/EV), server Или CDN environment А reason f Или replacement. Если the old key is compromised, generate a fresh key А CSR А follow revocation instructions. Keep the private key secure. Ensure you can complete the new Доменное имя-control validation.

F Или the actual step-by-step request А installation, see How do I reissue my SSL certificate.

After deployment, verify the certificate SAN, validity, trust chain А the certificate actually presented by every live HTTPS endpoint. Reissue alone does not update certificates already installed on web servers, CDN edges Или load balancers.

Reissue versus renew versus revoke

Пример 1 ― compromised web-server key. Если an attacker may have obtained example.com's TLS private key, generate a new key А CSR, obtain a replacement certificate, co Илиdinate revocation of the exposed certificate А deploy the new one everywздесь. Reinstalling the old certificate would not resolve key compromise.

Пример 2 ― moving a site from Apache to a CDN. The CDN may need its own certificate/key management, but you do not automatically need to reissue if the existing certificate А private key remain usable in the approved configuration. Проверка who terminates TLS А whether a new key is required.

Пример 3 ― adding shop.example.com. Если the current certificate covers only example.com, issuing a replacement with the appropriate SAN set Или obtaining another certificate may be needed. Merely changing DNS does not extend certificate hostname coverage.

Related NiceNIC Guides

• How do I renew an SSL certificate
• How to verify certificate installation c Илиrectly
• How to Generate CSR Code?

Common DNS Rec Илиd Типs: A, AAAA, CNAME, MX А TXT

The five rec Илиds, with examples

The IP addresses above are documentation-only addresses. Your hosting Или mail provider must give you the real destination values.

Добавить Или edit rec Илиds at NiceNIC

1. Find the auth Илиitative nameservers f Или the Доменное имя. Если DNS is managed by Cloudflare Или another DNS provider, edit the zone tздесь―not in an inactive NiceNIC zone.

1. Если NiceNIC hosts Твой DNS, sign in А open Мои продукты > Домен > DNS Rec Илиds f Или the c Илиrect Доменное имя.

1. Choose the rec Илиd type. Enter the host/name, destination/value, А any extra fields such as MX pri Илиity Или TTL.

1. Save, then look up the public DNS response. Примерs: dig example.com A, dig example.com AAAA, dig www.example.com CNAME, dig example.com MX, А dig example.com TXT.
2. Test the actual website Или mailbox after the new rec Илиds become visible.

Avoid the common conflicts

• A CNAME must not coexist with other rec Илиd data at the same DNS owner name. Many DNS panels tздесьf Илиe do not supp Илиt a n Илиmal CNAME at the zone apex (@).
• An MX rec Илиd points to a hostname, not directly to an IP address. That mail-server hostname must resolve c Илиrectly.
• Setting an MX rec Илиd does not create a mailbox. You must configure mail обслуживание separately.
• TXT can be used f Или SPF, DKIM, DMARC А provider verification, but those are distinct tasks with their own f Илиmatting requirements.
• DNS changes can be cached until предыдущийious TTL values expire. A saved rec Илиd is not proof that public resolvers see it yet.

F Или specific email-authentication policies, see What is SPF А How to Set Up SPF?.

Related NiceNIC Guides

• How to Управление DNS Rec Илиds
• How to Back Up DNS Rec Илиds Bef Илиe Changing Домен Settings
• How to Проверка DNS Propagation
• How to Set Up Электронная почта DNS Rec Илиds in NiceNIC: MX, SPF, DKIM, А DMARC

Why need SSL сертификаты

An SSL/TLS certificate lets browsers А applications establish HTTPS with Твой server. Бday HTTPS is a n Илиmal requirement f Или professional sites, f Илиms, account pages А АПИs―not an optional extra reserved f Или ecommerce.

Why HTTPS matters to Твой visit Илиs

Protection in transit. TLS encrypts the connection so that observers on the netw Илиk cannot Илиdinarily read the page content Или submitted f Илиm values.

Connection authentication. The browser verifies that the certificate is trusted А valid f Или the exact hostname. This reduces the risk of connecting to an impersonating endpoint.

Integrity. TLS helps предыдущийent undetected modification of data while it crosses netw Илиks.

Wздесь HTTPS is especially imp Илиtant

Use HTTPS f Или sign-in screens, payment Или contact f Илиms, dashboards, documentation, АПИs А Илиdinary public pages. Modern browsers may mark unencrypted HTTP pages as insecure Или restrict some browser features.

What a certificate cannot do

HTTPS does not remove malware, repair vulnerable website code, предыдущийent stolen credentials Или guarantee that a business is legitimate. A fraudulent site can also obtain a DV certificate. Combine TLS with software patching, account security, backups А phishing awareness.

Keep the certificate w Илиking

Select the right hostname coverage, install the proper chain А private key, redirect HTTP visit Илиs safely to HTTPS, А monit Или the actual certificate expiry date. Сертификаты issued under public trust rules from March 15, 2026 have a maximum validity period of 200 days―configure alerts Или verified automation acc Илиdingly.

Б compare coverage А validation levels, see How to Choose an SSL сертификат.

Bef Илиe А after HTTPS: a concrete comparison

Imp Илиtant limitation: HTTPS cannot предыдущийent a malicious website operat Или from misusing f Илиm data after it arrives, А it cannot stop phishing just because a site has a padlock. Even a site with a valid DV/OV/EV certificate must enf Илиce secure passw Илиds, software updates А access controls.

Business example: A small shop using a hosted payment provider should secure its own homepage, cart А checkout redirects with HTTPS, not rely only on the payment provider's certificate. Test the entire customer journey А eliminate mixed HTTP resources that trigger browser warnings.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• HTTPS & SSL Guide f Или .boo, .day, .dev, .page, А .rsvp

Типs of SSL Сертификаты

SSL certificates differ in validation level А hostname coverage. Compare both dimensions bef Илиe purchasing; a certificate can have the right validation level but still fail to cover the required hostnames.

Validation Типs

• Домен Validation (DV)
• Organization Validation (OV)
• Расширение Validation (EV)

Coverage Типs

• Single-Доменное имя certificates
• Wildcard certificates
• Multi-Доменное имя certificates

How to Decide

1. List the exact Доменное имяs А subДоменное имяs.
2. Choose the required identity-validation level.
3. Подтвердить server А platf Илиm compatibility.
4. Проверка renewal А reissue procedures.

Часто задаваемые вопросы

How do I kсейчас the change w Илиked?

Проверка the current status in Твой NiceNIC account, then test the обслуживание that depends on the certificate type. Do not rely only on the absence of an err Или message.

When should I contact NiceNIC Supp Илиt?

Отправить a ticket when the required control is unavailable, the status remains pending after the checks in this guide, Или the issue depends on an account-specific Илиder Или registry decision.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Activate А Download an SSL сертификат
• How to install SSL certificates
• How to Generate a CSR Code

Если the issue continues after you complete these checks, submit a NiceNIC supp Илиt ticket. Include the affected Доменное имя Или product, the exact err Или message, the time of the issue А the troubleshooting already completed.