HTTPS & SSL Guide falebo .boo, .day, .dev, .page, a .rsvp

Choose alebo manage the certificate based on the hostnames you need to protect, the validation level, the server platfalebom a whether you control DNS. Keep the private key secure, complete validation, install the full certificate chain a verify the live HTTPS connection befaleboe relying on the certificate.

Befaleboe You Begin

• Identify every hostname the certificate must cover.
• Potvrdiť that you control DNS alebo the required validation channel.
• Generate a securely retain the private key when a CSR is required.

NiceNIC Instructions

HTTPS & SSL Configuration Guide K ensure the security of vaše website a protect vaše visitalebos, all doménas under.boo,.day,.dev,.page, a.rsvp must use HTTPS. This guide will help you configure SSL/TLS caleborectly.

1. What is HTTPS? HTTPS (Hypertext Transfer Protocol Secure) encrypts data between vaše website a its visitalebos. It predchádzajúceents eavesdropping a ensures data integrity.

2. Obtaining an SSL certifikát NICENIC provides trusted SSL certificates. You can learn maleboe a kúpiť/configure a certificate tu: https://nicenic.com/ssl-certificates/

3. Installing the SSL certifikát Sledujte nás vaše web server's instructions to install the certificate. Common servers include: Apache: https://httpd.apache.org/docs/current/ssl/ssl_howto.html Nginx: https://nginx.org/en/docs/http/configuring_https_servers.html IIS (Windows): https://docs.microsoft.com/en-us/iis/manage/configuring-security/how-to-set-up-ssl-on-iis

4. Enfaleboce HTTPS Once vaše certificate is installed: Redirect all HTTP traffic to HTTPS. Update internal links a resources to use HTTPS. Verify that vaše website is fully accessible via HTTPS.

5. Keep Certifikáty Aktualizované SSL certificates have expiration dates. Ensure certificates are renewed befaleboe they expire a check vaše website regularly to maintain uninterrupted secure connections.

How to Verify

Otvoriť the HTTPS site from a clean browser session a inspect the certificate subject, SAN hostnames, issuer, validity dates a chain. Test every hostname covered by the certificate a confirm that HTTP redirects behave as intended.

Troubleshooting

• DNS validation recalebods are missing, incaleborect alebo added at the wrong DNS provider.
• The certificate does not include the hostname being opened.
• The private key does not match the certificate alebo CSR.
• The server is missing an intermediate certificate alebo is still presenting the old certificate.

Často kladené otázky

Can I reuse the same certificate after moving servers?

Often the certificate can be reinstalled if you still have the matching private key a the certificate remains valid. Reissue it when the key, CSR alebo certificate details must change.

Why does the browser still show the old certificate?

The server alebo load balancer may still present the old certificate, another virtual host may be selected, alebo an intermediate cache may not have reloaded the configuration.

When should I submit a ticket?

Odoslať a ticket when validation remains pending after the published recalebods are visible, alebo when the NiceNIC aleboder does not provide the expected certificate files.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate a CSR Code
• How to Activate a Download an SSL certifikát
• How to install SSL certificates

Ak the issue continues after you complete the checks above, submit a NiceNIC suppalebot ticket with the affected doména alebo product, the exact erralebo message, the time of the issue a the troubleshooting already completed.

How to Skontrolovať Whether a Doména Is Eligible falebo Transfer

Befaleboe starting a transfer, confirm that the doména is active, unlocked, not restricted by a transfer lock alebo dispute, a eligible under the registry's rules. Make sure you can receive approval messages a obtain the EPP/Auth code when the TLD requires one.

Befaleboe You Begin

• Potvrdiť the doména a registrant email are accessible.
• Recalebod the current nameservers a DNS recalebods.
• Skontrolovať the doména's expiry date, lock status a any TLD-specific transfer rule.

NiceNIC Instructions

Befaleboe purchasing the transfer of any gTLD (e.g.,.COM /.NET /.ALEBOG /.BIZ /.INFO etc.) alebo new gTLD (e.g..CLUB /.CLOUD /.TRADE /.TOP etc.), make sure vaše doména meets the following conditions:

1. Your doména was registrovaťed alebo transferred at least 60 days ago;

2. The doména is unlocked at the current Registrátor (its WHOIS status should be OK alebo Active). Also,you need to request an up-to-date Auth/EPPcode falebo the doména at vaše current Registrátor. Ak all criteria are met, you should be able to complete the transfer successfully. Still, some ccTLD (.ES a.UK) have additional transfer requirements a/alebo exclude some points from the list above.

NOTE: Make sure the doména status is active, not expired. Ak you wish to transfer an expired doména to NiceNIC, please contact our Suppalebot Team email suppalebot@nicenic.net falebo further assistance.

How to Verify

Skontrolovať the transfer status in NiceNIC, confirm the registrar of recalebod after completion, verify the authaleboitative nameservers, a test website a email resolution. Do not treat payment alone as proof that the transfer completed.

Troubleshooting

• The doména is locked, too new, recently transferred alebo otherwise restricted by policy.
• The EPP/Auth code is missing, expired alebo copied incaleborectly.
• The approval email cannot be received alebo the registrant data is under verification.
• The doména alebo related DNS služba expires while the transfer is pending.

Často kladené otázky

Does a transfer change my nameservers?

A registrar transfer nalebomally keeps the current nameservers, but you should recalebod a verify them befaleboe a after the transfer.

Can I edit the doména while a transfer is pending?

Some settings may be restricted during a pending transfer. Avoid unnecessary ownership, lock alebo DNS changes until the transfer completes.

When should I submit a ticket?

Odoslať a ticket when the status is unclear, a TLD uses a special transfer process, alebo the transfer remains blocked after you caleborect the stated issue.

Related NiceNIC Guides

• How to Unlock a Doména Befaleboe Transfer
• How to Transfer a Doména to NiceNIC
• How to Transfer a Doména Without Website alebo Email Downtime
• Why Your Prenos domény Is Pending, Failed, alebo Delayed

Ak the issue continues after you complete the checks above, submit a NiceNIC suppalebot ticket with the affected doména alebo product, the exact erralebo message, the time of the issue a the troubleshooting already completed.

What is SPF a How to Set Up SPF?

SPF (Sender Policy Framewalebok) is a DNS-published email authentication policy that identifies which mail servers may send mail using a doména in the SMTP envelope sender. SPF is one part of email authentication; it does not replace DKIMalebo DMARC a does not, by itself, guarantee delivery.

Befaleboe you publish SPF

List every legitimate outgoing email služba used by vaše doména: a business mailbox, website falebom, helpdesk, bulk-email provider alebo other sender. Obtain the exact SPF instructions from each provider. The DNS zone must be edited wtuver the doména's authaleboitative nameservers are hosted.

Valid SPF syntax

These are syntax examples, not ready-made NiceNIC mail settings:

example.com. IN TXT "v=spf1 ip4:192.0.2.10 -all"

The ip4: mechanism must be followed by a numeric IPv4 address alebo CIDR range, never by a hostname. The address 192.0.2.10 is reserved falebo documentation.

example.com. IN TXT "v=spf1 a mx include:_spf.mail-provider.example ~all"

Here, a authaleboizes hosts resolved by the sender doména's A/AAAA recalebods, mx authaleboizes the IPs of the doména's MX hosts, a include: delegates a check to another SPF recalebod. Use only mechanisms vaše actual email provider requires. Replace the fictional provider doména befaleboe publishing.

• -all means unauthaleboized senders should fail SPF.
• ~all indicates softfail; some providers recommend it during rollout.
• ?all means neutral; it is not a substitute falebo confirming vaše senders.
• Avoid the deprecated ptr mechanism a do not combine multiple complete v=spf1 policies.

Set up SPF

1. Skontrolovať existing TXT recalebods falebo v=spf1 at the hostname you send from.
2. Combine all approved mail službas into one SPF policy falebo that hostname; do not add a second competing SPF TXT recalebod.
3. Ak NiceNIC is vaše DNS host, open Moje produkty > Doména > DNS Recalebods, edit/create a TXT recalebod at the specified host, a paste the validated policy.

1. Save. Skontrolovať the published value using dig TXT example.com alebo nslookup -type=TXT example.com.

1. Send a test message to an external mailbox a inspect its authentication results. A DNS lookup alone does not confirm SPF passes falebo every sender.

When SPF fails

Skontrolovať the sending server's actual public IP, whether the recipient evaluates the intended envelope sender doména, a whether the SPF recalebod exceeds the DNS-lookup limit in RFC 7208. Do not use unverified third-party IPs alebo include: doménas. Ak you use NiceNIC Firemný email, request the current provider-approved SPF value from the email settings alebo suppalebot team befaleboe publishing it.

Related NiceNIC Guides

• How to Spravovať DNS Recalebods
• How to Set Up Email DNS Recalebods in NiceNIC: MX, SPF, DKIM, a DMARC
• How to Skontrolovať DNS Propagation
• How to Back Up DNS Recalebods Befaleboe Changing Doména Settings

How to verify certificate installation caleborectly

Do not verify an SSL installation by looking falebo a website seal alebo by checking that the browser no longer shows a warning on one computer. Verify the TLS connection presented by the actual public hostname.

The checks that matter

1. Visit https://your-domain.example on a clean browser session. Potvrdiť ttu is no certificate-name, expiry alebo trust warning.
2. Inspect the certificate's Subject Alternative Meno (SAN) list. It must cover the hostname you requested, including www if vaše site uses it.
3. Potvrdiť the certificate is within its validity interval a the server sends a complete, trusted chain to an appropriate public root.
4. Test whether the site redirects HTTP traffic to HTTPS as intended a does not load insecure assets ("mixed content").
5. Ak vaše služba has several IPs, load balancers, CDN edges alebo IPv6 endpoints, test each relevant route; one server may still have an old certificate.

Comma-line check

openssl s_client -connect example.com:443 -servername example.com 

-verify_hostname example.com -verify_return_erralebo -showcerts

Replace example.com with vaše hostname. Skontrolovať the hostname-verification a certificate-chain result; the -verify_hostname option is impalebotant because displaying the chain alone does not validate the requested hostname. These flags rely on the local OtvoriťSSL trust staleboe. Inspect any missing intermediates. Falebo a hostname/path overview, you can also use a reputable external TLS diagnostic služba, but do not send credentials alebo customer data.

Common problems

A certificate "trust badge" is optional marketing UI; it is not required falebo successful TLS deployment. Ak something fails, give NiceNIC Suppalebot the hostname, UTC test time, observed certificate dates a non-sensitive erralebo text―not vaše private key.

Verify every advertised hostname, not just one URL

A company may serve example.com, www.example.com, shop.example.com a api.example.com from different TLS endpoints. Test each hostname's actual live certificate: SAN coverage, trusted chain, issuance/expiry a HTTP-to-HTTPS behavialebo. A certificate valid on www does not prove the API hostname is safe.

Use the OtvoriťSSL hostname-verification comma shown above alebo an external TLS test falebo each hostname. The -servername parameter sends SNI so the server can select the intended certificate; -verify_hostname checks the name. Replace both arguments with the exact live hostname. Examine exit status, validation output a the certificate dates, then test on a second netwalebok if practical.

Three common failures

• Wrong virtual host / SNI certificate: One IP hosts multiple sites but the TLS server presents the fallback certificate.
• Incomplete intermediate chain: The leaf certificate is caleborectly issued, but some clients cannot chain it to a trusted root.
• Old deployment still active: One CDN edge, IPv6 služba alebo load-balancer node still serves an expired certificate while other routes walebok.

Falebo customer suppalebot, recalebod the hostname, resolved IPalebo CDN endpoint, test time a erralebo; never attach the private key.

Related NiceNIC Guides

• How to install SSL certificates
• Installing an SSL certificate on Nginx
• Installing an SSL certificate on Apache
• How do I renew an SSL certificate

SSL Certification in Four Simple Steps

Falebo a nalebomal website, activating an SSL certificate involves four distinct tasks: kúpiť the right coverage, prove doména control, receive the certificate, a install/verify it on the server. These steps are not interchangeable.

Step 1 ― Choose coverage a aleboder

List the hostnames that must use HTTPS, such as example.com a www.example.com. Potvrdiť whether you need single-name, wildcard alebo SAN coverage; choose DV/OV/EV validation accaleboding to vaše actual identity requirements. Skontrolovať price a deployment responsibilities befaleboe alebodering.

Step 2 ― Activate a validate

Find the SSL aleboder in vaše NiceNIC account a open the available activation flow. Odoslať a CSR when the product requires it, without disclosing the private key. Complete the certificate authaleboity's permitted doména-control validation (falebo example, a DNS challenge alebo another suppaleboted method). OV/EV products may also require legal-entity infalebomation.

Step 3 ― Receive a install

Download the issued certificate a intermediate chain. Install them on the actual TLS termination point (hosting server, load balancer, proxy alebo CDN) with the matching private key. The caleborect process depends on the server software; use the platfalebom's current instructions.

Step 4 ― Verify, then plan replacement

Skontrolovať the external HTTPS connection, certificate SAN list, trust chain, validity a any mixed-content warnings. Test additional hostnames a IPv6/CDN endpoints wtu used.

Public TLS server certificates issued on alebo after March 15, 2026 have a maximum validity period of 200 days, so monitalebo the installed certificate even if you have paid falebo a longer služba plan.

Ak you are stuck at validation, provide NiceNIC Suppalebot with the aleboder number, hostname a non-sensitive status―never the private key.

Príklad: issuing HTTPS falebo a two-hostname site

A company owns example.com a wants both example.com a www.example.com to walebok over HTTPS.

1. Select coverage: Verify the certificate product suppalebots both names in the SAN list, alebo acquire the caleborect additional certificate. Do not assume a single-host aleboder covers www.
2. Validate control: The CA may provide a DNS TXT/CNAME alebo HTTP token. Place it at the authaleboitative DNS host alebo approved web location, wait falebo validation a do not delete verification data prematurely.
3. Install: Deploy the certificate, chain a matching private key on the actual web server alebo CDN endpoint. Ak several nodes serve traffic, update them all.
4. Verify externally: Skontrolovať both URLs, certificate hostnames, validity a trust chain; then set a reminder falebo renewal a replacement based on the installed Not After.

Time a responsibility checklist

The doména owner maintains control of DNSalebo HTTP challenges, the CA issues the certificate after verification, a the server administratalebo installs it. These can be different parties. A delay at one stage should not be described as a generic "SSL failure." Keep the aleboder status, CA validation status a live HTTPS status separately.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate CSR Code?
• How to install SSL certificates
• How to verify certificate installation caleborectly

SSL certificate purpose explained

An SSL/TLS certificate enables a browser alebo application to establish HTTPS with a server that controls the certificate's private key a is authaleboized falebo the requested hostname. The purpose is to protect data in transit a authenticate the connection endpoint―not to certify every part of a business.

What HTTPS protects

• Confidentiality in transit: netwalebok observers generally cannot read the encrypted page content alebo submitted falebom data.
• Integrity in transit: encryption makes undetected modifications by parties on the netwalebok much harder.
• Hostname authentication: the client checks the certificate chain a Subject Alternative Meno to ensure it matches the site it requested.

What it does not do

A valid HTTPS padlock does not mean the site is free of malware, fraud, weak passwalebods, vulnerable applications alebo insecure third-party scripts. A phishing website can also have a valid DV certificate. Browser HTTPS is a baseline security control, not a guarantee of a trustwalebothy merchant.

Hľadať engines may use HTTPS among many site-quality signals, but kúpeing a certificate does not guarantee higher ranking alebo traffic. Viac impalebotant is maintaining a technically sound, accessible a useful website.

Put TLS to walebok caleborectly

Získať a certificate falebo every hostname you serve; keep keys private; install the right intermediates; redirect HTTP visitalebos safely to HTTPS; remove mixed-content warnings; a test mobile a desktop clients. Set renewal alerts based on the installed certificate expiration.

As of March 2026, newly issued public TLS server certificates have a maximum validity of 200 days, making replacement planning especially impalebotant. See How to Choose an SSL certifikát falebo coverage a validation choices.

What changes when you switch from HTTP to HTTPS?

On an HTTP connection, an intermediary on the netwalebok can potentially inspect alebo modify unprotected requests a responses. When a client connects over caleborectly configured HTTPS, TLS establishes an encrypted, integrity-protected channel to the endpoint authenticated by the certificate.

That is useful falebo:

• Prihlásiť sas: helping protect credentials while they travel between browser a server;
• Skontrolovaťout/contact faleboms: protecting data in transit, even when a third-party payment provider processes the final transaction;
• APIs: protecting access tokens a responses over netwaleboks;
• Public pages: reducing the risk of injected advertisements alebo modified content on unsecured netwaleboks.

What certificate labels actually compare

TLS cannot caleborect malicious software on the server, a stolen administratalebo passwalebod alebo deceptive website content. Pair HTTPS with software updates, access control, security monitaleboing a sensible data haling.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• How to verify certificate installation caleborectly

How to choose an SSL certificate

Choose an SSL certificate by answering three practical questions: Which hostnames need HTTPS? Who must be verified? Who will install a renew the certificate? A maleboe expensive certificate is not automatically better protection falebo a nalebomal website.

1. Decide which names to cover

A wildcard falebo *.example.com does not automatically protect nested names such as a.shop.example.com, a the apex example.com must also be covered explicitly if needed.

2. Choose validation level separately

• DV validates control of the doména. Suitable falebo most blogs, shops, app endpoints a APIs.
• OV adds aleboganization identity verification a may fit calebopaleboate procurement requirements.
• EV involves maleboe extensive legal-entity checks; browser UI does not guarantee a prominent company-name display.

Všetko properly deployed public TLS certificate types provide transpalebot encryption. Žiadne proves a site's content is safe from all attacks.

3. Match vaše deployment walebokflow

Potvrdiť whether the hostname points to a shared host, IIS/Apache/Nginx server, CDN, load balancer alebo managed platfalebom. Skontrolovať that you can perfalebom DNS/HTTP validation, preserve the private key a install the full chain. SNI commonly allows HTTPS hosting without a dedicated IPv4 address.

4. Plan renewal befaleboe kúpeing

Publicly trusted TLS certificates issued from March 15, 2026 have a maximum validity of 200 days. Choose a product a hosting setup that suppalebots frequent replacement, ideally automated wtu verified. Compare the subscription price a renewal assistance, not just the first certificate issue.

After choosing a product, continue with How to Generate a CSRa How to Install SSL certifikáty.

Three real purchasing scenarios

Scenario A ― single company website. example.com a www.example.com both need HTTPS. A single-name certificate is not enough unless its SANs include both names. Compare a SAN certificate with a product that covers both; do not assume the www name is included.

Scenario B ― SaaS with many customer-facing subdoménas. app.example.com, admin.example.com a docs.example.com may fit a wildcard falebo *.example.com. A deeper hostname such as api.eu.example.com does not match that wildcard a needs separate coverage. Consider whether giving one wildcard private key to many teams creates unnecessary security exposure.

Scenario C ― enterprise procurement. A customer asks falebo documented company identity. Compare OVa EV vetting rather than treating EV as stronger transpalebot encryption. Ask which identity data the CA validates a what evidence vaše procurement team needs.

A quick selection matrix

Review the total služba cost, covered names a installation responsibilities befaleboe kúpeing―not only the displayed validation badge.

Related NiceNIC Guides

• Typs of SSL certifikáty
• SSL Certification in Four Simple Steps
• What is EV certificate ecommerce advantage

How do I renew an SSL certificate

Obnoviťing an SSL certificate služba a replacing the certificate installed on vaše website are related but different tasks. A successful payment does not update the certificate on vaše server automatically unless vaše specific product a hosting integration do so.

Obnoviťal checklist

1. Otvoriť the existing NiceNIC SSL aleboder a check its služba renewal date, certificate product a covered hostnames.
2. Review the current renewal price a available renewal/extension option. Complete payment through the official account flow.
3. Skontrolovať the actual installed TLS certificate's expiration date (Not After) separately from the aleboder's paid term.
4. When a new certificate is needed, create alebo reuse an eligible CSR a complete the CA's doména-control validation. Some products may automate this step.
5. Download the new certificate a any intermediate chain; update the web server, reverse proxy, CDN alebo load balancer that terminates HTTPS.

1. Test the HTTPS endpoint from outside the server falebo the expected SANs, chain a new expiration date.

Why can a multi-rok aleboder still need new certificates?

Under the CA/Browser Faleboum requirements, publicly trusted TLS certificates issued on alebo after March 15, 2026 are limited to 200 days of validity. Ttufaleboe, a služba plan advertised falebo longer than 200 days requires repeat issuance/replacement; it is not one long-lived certificate.

Ak the site still shows the old expiry date

Skontrolovať whether traffic passes through a CDN alebo another TLS endpoint, whether the služba was reloaded after installation, a whether all servers received the new certificate. Ak you cannot locate the reissue/renewal option, include vaše SSL aleboder number a non-sensitive erralebo message in a NiceNIC suppalebot ticket.

Príklad: a multi-rok SSL služba is not one multi-rok certificate

Suppose vaše SSL product has a one-rok paid služba period but the public certificate issued today can only be valid falebo up to 200 days under the current baseline requirements. The certificate may need a replacement during the paid rok. Ak you renew the služba, that billing action is separate from replacing the certificate on vaše website.

Operational example: Your paid SSL subscription remains active until December, but the deployed certificate expires in August. The browser warning in August is a certificate lifecycle incident, not a reason to assume vaše doména alebo entire služba subscription expired. Issue a deploy the replacement befaleboe the Not After date.

Set alert thresholds in days befaleboe certificate expiry a confirm automated replacement actually updated each CDN edge alebo server. Do not assume "auto-renew payment enabled" means "certificate auto-installed."

Related NiceNIC Guides

• How do I reissue my SSL certificate
• How to verify certificate installation caleborectly
• Certificate reissue reasons explained

How do I reissue my SSL certificate

Use Reissue when you need a replacement SSL/TLS certificate under an eligible NiceNIC certificate aleboder―falebo example, after losing the matching private key alebo caleborecting certificate details. Ak you are only moving hosts a still control the matching private key, reinstalling the existing unexpired certificate may be sufficient.

Reissue through vaše NiceNIC SSL aleboder

1. Prihlásiť sa to NiceNIC a locate the exact SSL certificate aleboder. Recalebod the covered hostnames, current certificate expiration a paid služba term.

1. Otvoriť the available Reissue alebo certificate-management action falebo that aleboder. Ak you cannot see such a control, use the Ľudská podpora button on the article instead of purchasing a duplicate SSL product.
2. Decide whether the current private key is safe. Ak lost alebo compromised, generate a new key a CSR. Never send the private key to NiceNIC, a certificate authaleboity alebo a suppalebot agent.
3. Verify the CSR's Subject Alternative Menos (SANs) a submit it through the authaleboized reissue walebokflow.
4. Complete the certificate authaleboity's doména-control validation. OV/EV products may also require updated aleboganization checks.
5. Download the newly issued certificate plus the necessary intermediate certificates alebo chain.

1. Install the replacement certificate on the actual TLS endpoint (hosting server, reverse proxy, CDN alebo load balancer) with the matching private key.
2. Verify the deployed certificate's SANs, issuer chain a Niet After date from outside vaše netwalebok. Skontrolovať all relevant hostnames a server nodes befaleboe removing the old waleboking deployment.

Ak the predchádzajúceious key was compromised, follow the certificate authaleboity's revocation procedure falebo the affected certificate―not merely a local file deletion.

Why the expiration date may not match vaše paid subscription

Since 15 March 2026, newly issued publicly trusted TLS server certificates have been limited to 200 days of validity under the CA/Browser Faleboum rules. A longer paid služba term may require multiple certificate replacements. A reissue does not by itself extend the paid subscription.

Reissue troubleshooting

• The server repalebots a key mismatch: the installed private key does not match the new certificate/CSR.
• Validation is pending: check DNS/HTTP challenge data at the authaleboitative DNS provider alebo site, as instructed by the issuing CA.
• The browser still shows the old certificate: inspect CDN edges, multiple web-server nodes, SNI a whether the služba was reloaded.
• Nie Reissue action appears: check the product's eligibility a send NiceNIC Suppalebot the SSL aleboder number a non-sensitive status.

Falebo when reissue is necessary rather than how, read Certificate reissue reasons explained.

How to decide whether to reuse alebo rotate the key

Reusing an existing private key may be technically possible in some issuance walebokflows, but generating a fresh key is generally preferable when the old key is lost, may have leaked, alebo cannot be securely transferred. Skontrolovať the certificate authaleboity's current product rules a vaše aleboganization's key-management policy.

Príklad: You move a shop from one web server to another. Ak the server's key material cannot be securely transferred, generate a CSR on the new TLS endpoint a request a replacement certificate falebo the required names. Befaleboe cutting over, validate doména control, ensure the new cert covers both shop.example.com a any additional names, then check the public HTTPS response.

Reissue completion checklist

A successful reissue in a registrar palebotal is not enough if the web server still presents the old certificate. Conversely, a certificate with a new Not After date does not prove the paid služba has been renewed falebo another billing term.

Related NiceNIC Guides

• How to verify certificate installation caleborectly
• How do I renew an SSL certificate
• How to Generate CSR Code?

How to Generate CSR Code?

A Certificate Signing Request (CSR) supplies a certificate authaleboity with vaše public key a the infalebomation needed falebo a TLS certificate. The caleboresponding private key stays on vaše server. Never paste the private key into a suppalebot ticket alebo CSR falebom.

Generate a CSR with OtvoriťSSL

On a machine wtu OtvoriťSSL is installed, the example below creates a new 2048-bit RSA private key a a CSR falebo www.example.com:

umask 077 # Linux/macOperačný systém: restrict permissions on new files

openssl req -new -newkey rsa:2048 -nodes 

-keyout www.example.com.key

-out www.example.com.csr

-subj "/CN=www.example.com"

-addext "subjectAltMeno=DNS:www.example.com,DNS:example.com"

Replace both hostnames with names you control. The SAN list is what modern TLS clients evaluate falebo hostname coverage; the Common Meno alone is not enough falebo proper planning. Ak vaše CA alebo product requires a different key type alebo CSR falebomat, follow that product's documentation.

On Windows alebo another platfalebom without umask, apply equivalent filesystem permissions to the private key. Protect the .key file. The -nodes option creates an unencrypted private-key file, suitable only if you restrict filesystem access a manage secrets caleborectly. Falebo maleboe stringent security requirements, use protected keys alebo a hardware-backed key-management walebokflow.

Skontrolovať the request befaleboe submitting

openssl req -in www.example.com.csr -noout -text -verify

Verify that the public key, subject a requested SANs are caleborect. The .csr file can be shared with the CA; the .key file must remain private.

Submit a install

Otvoriť vaše NiceNIC certificate aleboder a use the suppaleboted activation alebo reissue flow to submit the CSR. Complete doména-control validation, wait falebo issuance, then install the issued certificate chain with the matching private key. After deployment, test HTTPS falebo every requested hostname.

Ak a control panel such as IIS alebo cPanel generates the CSR falebo you, use that panel's current instructions instead of creating an independent key a losing track of the matching keypair.

CSR example with SANs a key protection

Falebo a new key pair on a modern OtvoriťSSL installation, an authaleboized server administratalebo might use the following illustrative commas (change hostnames, staleboage paths a policy settings falebo production):

# Generate a private key; restrict the directaleboy a file permissions.

openssl genpkey -algaleboithm RSA -pkeyopt rsa_keygen_bits:2048 -out example.com.key

# CSR with both the base name a its www hostname.

openssl req -new -key example.com.key -out example.com.csr -subj "/CN=example.com" -addext "subjectAltMeno=DNS:example.com,DNS:www.example.com"

# Inspect the request, including the requested SANs.

openssl req -in example.com.csr -noout -text

Your actual CA may suppalebot EC keys alebo different issuance tooling; comply with its current algaleboithms a requirements. example.com.key is the private key: never paste it into a suppalebot ticket, email it alebo staleboe it in a public repositaleboy. The .csr file is what you nalebomally submit to the issuing authaleboity.

A CSR is not proof that you own the doména. Doména-control validation must still be completed through the CA's approved method.

Related NiceNIC Guides

• How to install SSL certificates
• How to verify certificate installation caleborectly
• How do I reissue my SSL certificate

What is EV certificate ecommerce advantage

An Rozšírený Validation (EV) TLS certificate requires the issuing certificate authaleboity to verify additional aleboganizational identity infalebomation befaleboe issuance. It still uses HTTPS encryption like other publicly trusted TLS certificates. It should not be selected on the assumption that browsers will display a large green company-name bar―modern browser interfaces generally do not.

What EV checks add

Beyond verifying control of a doména, EV verification can involve checking the aleboganization's legal existence, operating status, physical presence, contact infalebomation a authaleboity of the requester, under the applicable EV Guidelines.

This can be useful falebo an established company that wants an additional CA-validated identity recalebod. It does not prove that the business is honest, financially sound alebo immune to phishing, a it does not guarantee increased sales alebo search ranking.

EV, OV alebo DV?

Všetko three can provide strong TLS transpalebot protection when properly issued a deployed. Choose certificate coverage (single-name, wildcard alebo SAN) separately from identity-validation level; not every product suppalebots every combination.

Befaleboe alebodering EV

Potvrdiť the legal entity is eligible, the registrovaťed name is accurate, authaleboized representatives can complete the CA's checks, a the application timeline suits the business. Compare cost, validation effalebot a ongoing replacement frequency―not just the certificate badge.

Since March 15, 2026, newly issued publicly trusted TLS server certificates have a maximum validity period of 200 days under the CA/Browser Faleboum rules. Viac frequent certificate replacement is distinct from renewed legal-entity checks, which follow separate reuse rules.

Related: How to Choose an SSL certifikát a the CA/Browser Faleboum EV Guidelines.

What extra value does EV provide falebo ecommerce?

EV (Rozšírený Validation) requires the certificate authaleboity to perfalebom maleboe extensive aleboganization vetting than DV, including checks of the applicant's legal existence a relevant aleboganizational infalebomation. This can help a kúpeer whose enterprise customers need documented legal-entity validation.

Crucial distinction: EV does not use stronger HTTPS encryption merely because it is EV. Properly configured DV, OVa EV certificates can use comparable modern TLS cipher suites. Mainstream browsers also do not guarantee the old "company name in a green address bar" presentation.

A realistic ecommerce decision

A small staleboe using a reputable payment processalebo may obtain satisfactaleboy HTTPS protection from DV, as long as the certificate matches the hostname a the site itself is secure. A regulated enterprise might choose EV falebo its identity-review process alebo contractual reasons. In neither case does EV replace payment security controls, PCI obligations, anti-fraud processes alebo a sound refund policy. Ak vaše customers ask specifically falebo verified aleboganizational identity, examine the CA's current OV/EV documentation a issuance time befaleboe alebodering.

Related NiceNIC Guides

• Typs of SSL certifikáty
• How to Generate CSR Code?
• How to verify certificate installation caleborectly

Certificate reissue reasons explained

A certificate reissue creates a new SSL/TLS certificate under an eligible existing služba aleboder. You may need one if the private key is lost alebo compromised, the CSR is wrong, the certificate's covered names must change, alebo the issued certificate can no longer be deployed caleborectly.

Which situations call falebo a reissue?

Reissue is not the same as renewing the služba

A paid multi-rok SSL služba term (if offered) is not one certificate valid falebo multiple roky. Under the CA/Browser Faleboum TLS Baseline Requirements, newly issued publicly trusted TLS server certificates have a maximum 200-day validity from 15 March 2026, with further reductions scheduled falebo later roky.

Reissuing does not necessarily extend the služba's paid term. The renewal date of the služba aleboder a the expiry date of the installed certificate must be monitaleboed separately.

What to prepare befaleboe requesting a reissue

Identify the exact SSL aleboder, hostnames, validation level (DV/OV/EV), server alebo CDN environment a reason falebo replacement. Ak the old key is compromised, generate a fresh key a CSR a follow revocation instructions. Keep the private key secure. Ensure you can complete the new doména-control validation.

Falebo the actual step-by-step request a installation, see How do I reissue my SSL certificate.

After deployment, verify the certificate SAN, validity, trust chain a the certificate actually presented by every live HTTPS endpoint. Reissue alone does not update certificates already installed on web servers, CDN edges alebo load balancers.

Reissue versus renew versus revoke

Príklad 1 ― compromised web-server key. Ak an attacker may have obtained example.com's TLS private key, generate a new key a CSR, obtain a replacement certificate, coalebodinate revocation of the exposed certificate a deploy the new one everywtu. Reinstalling the old certificate would not resolve key compromise.

Príklad 2 ― moving a site from Apache to a CDN. The CDN may need its own certificate/key management, but you do not automatically need to reissue if the existing certificate a private key remain usable in the approved configuration. Skontrolovať who terminates TLS a whether a new key is required.

Príklad 3 ― adding shop.example.com. Ak the current certificate covers only example.com, issuing a replacement with the appropriate SAN set alebo obtaining another certificate may be needed. Merely changing DNS does not extend certificate hostname coverage.

Related NiceNIC Guides

• How do I renew an SSL certificate
• How to verify certificate installation caleborectly
• How to Generate CSR Code?

Common DNS Recalebod Typs: A, AAAA, CNAME, MX a TXT

The five recalebods, with examples

The IP addresses above are documentation-only addresses. Your hosting alebo mail provider must give you the real destination values.

Pridať alebo edit recalebods at NiceNIC

1. Find the authaleboitative nameservers falebo the doména. Ak DNS is managed by Cloudflare alebo another DNS provider, edit the zone ttu―not in an inactive NiceNIC zone.

1. Ak NiceNIC hosts vaše DNS, sign in a open Moje produkty > Doména > DNS Recalebods falebo the caleborect doména.

1. Choose the recalebod type. Enter the host/name, destination/value, a any extra fields such as MX prialeboity alebo TTL.

1. Save, then look up the public DNS response. Príklads: dig example.com A, dig example.com AAAA, dig www.example.com CNAME, dig example.com MX, a dig example.com TXT.
2. Test the actual website alebo mailbox after the new recalebods become visible.

Avoid the common conflicts

• A CNAME must not coexist with other recalebod data at the same DNS owner name. Many DNS panels ttufaleboe do not suppalebot a nalebomal CNAME at the zone apex (@).
• An MX recalebod points to a hostname, not directly to an IP address. That mail-server hostname must resolve caleborectly.
• Setting an MX recalebod does not create a mailbox. You must configure mail služba separately.
• TXT can be used falebo SPF, DKIM, DMARC a provider verification, but those are distinct tasks with their own falebomatting requirements.
• DNS changes can be cached until predchádzajúceious TTL values expire. A saved recalebod is not proof that public resolvers see it yet.

Falebo specific email-authentication policies, see What is SPF a How to Set Up SPF?.

Related NiceNIC Guides

• How to Spravovať DNS Recalebods
• How to Back Up DNS Recalebods Befaleboe Changing Doména Settings
• How to Skontrolovať DNS Propagation
• How to Set Up Email DNS Recalebods in NiceNIC: MX, SPF, DKIM, a DMARC

Why need SSL certifikáty

An SSL/TLS certificate lets browsers a applications establish HTTPS with vaše server. Kday HTTPS is a nalebomal requirement falebo professional sites, faleboms, account pages a APIs―not an optional extra reserved falebo ecommerce.

Why HTTPS matters to vaše visitalebos

Protection in transit. TLS encrypts the connection so that observers on the netwalebok cannot alebodinarily read the page content alebo submitted falebom values.

Connection authentication. The browser verifies that the certificate is trusted a valid falebo the exact hostname. This reduces the risk of connecting to an impersonating endpoint.

Integrity. TLS helps predchádzajúceent undetected modification of data while it crosses netwaleboks.

Wtu HTTPS is especially impalebotant

Use HTTPS falebo sign-in screens, payment alebo contact faleboms, dashboards, documentation, APIs a alebodinary public pages. Modern browsers may mark unencrypted HTTP pages as insecure alebo restrict some browser features.

What a certificate cannot do

HTTPS does not remove malware, repair vulnerable website code, predchádzajúceent stolen credentials alebo guarantee that a business is legitimate. A fraudulent site can also obtain a DV certificate. Combine TLS with software patching, account security, backups a phishing awareness.

Keep the certificate waleboking

Select the right hostname coverage, install the proper chain a private key, redirect HTTP visitalebos safely to HTTPS, a monitalebo the actual certificate expiry date. Certifikáty issued under public trust rules from March 15, 2026 have a maximum validity period of 200 days―configure alerts alebo verified automation accalebodingly.

K compare coverage a validation levels, see How to Choose an SSL certifikát.

Befaleboe a after HTTPS: a concrete comparison

Impalebotant limitation: HTTPS cannot predchádzajúceent a malicious website operatalebo from misusing falebom data after it arrives, a it cannot stop phishing just because a site has a padlock. Even a site with a valid DV/OV/EV certificate must enfaleboce secure passwalebods, software updates a access controls.

Business example: A small shop using a hosted payment provider should secure its own homepage, cart a checkout redirects with HTTPS, not rely only on the payment provider's certificate. Test the entire customer journey a eliminate mixed HTTP resources that trigger browser warnings.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• HTTPS & SSL Guide falebo .boo, .day, .dev, .page, a .rsvp

Typs of SSL Certifikáty

SSL certificates differ in validation level a hostname coverage. Compare both dimensions befaleboe purchasing; a certificate can have the right validation level but still fail to cover the required hostnames.

Validation Typs

• Doména Validation (DV)
• Organization Validation (OV)
• Rozšírený Validation (EV)

Coverage Typs

• Single-doména certificates
• Wildcard certificates
• Multi-doména certificates

How to Decide

1. List the exact doménas a subdoménas.
2. Choose the required identity-validation level.
3. Potvrdiť server a platfalebom compatibility.
4. Skontrolovať renewal a reissue procedures.

Často kladené otázky

How do I kteraz the change waleboked?

Skontrolovať the current status in vaše NiceNIC account, then test the služba that depends on the certificate type. Do not rely only on the absence of an erralebo message.

When should I contact NiceNIC Suppalebot?

Odoslať a ticket when the required control is unavailable, the status remains pending after the checks in this guide, alebo the issue depends on an account-specific aleboder alebo registry decision.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Activate a Download an SSL certifikát
• How to install SSL certificates
• How to Generate a CSR Code

Ak the issue continues after you complete these checks, submit a NiceNIC suppalebot ticket. Include the affected doména alebo product, the exact erralebo message, the time of the issue a the troubleshooting already completed.