HTTPS & SSL Guide fali .boo, .day, .dev, .page, in .rsvp

Choose ali manage the certificate based on the hostnames you need to protect, the validation level, the server platfalim in whether you control DNS. Keep the private key secure, complete validation, install the full certificate chain in verify the live HTTPS connection befalie relying on the certificate.

Befalie You Begin

• Identify every hostname the certificate must cover.
• Potrdi that you control DNS ali the required validation channel.
• Generate in securely retain the private key when a CSR is required.

NiceNIC Instructions

HTTPS & SSL Configuration Guide Za ensure the security of vašega website in protect vašega visitalis, all domenas under.boo,.day,.dev,.page, in.rsvp must use HTTPS. This guide will help you configure SSL/TLS calirectly.

1. What is HTTPS? HTTPS (Hypertext Transfer Protocol Secure) encrypts data between vašega website in its visitalis. It prejents eavesdropping in ensures data integrity.

2. Obtaining an SSL potrdilo NICENIC provides trusted SSL certificates. You can learn malie in kupi/configure a certificate tukaj: https://nicenic.com/ssl-certificates/

3. Installing the SSL potrdilo Sledi vašega web server's instructions to install the certificate. Common servers include: Apache: https://httpd.apache.org/docs/current/ssl/ssl_howto.html Nginx: https://nginx.org/en/docs/http/configuring_https_servers.html IIS (Windows): https://docs.microsoft.com/en-us/iis/manage/configuring-security/how-to-set-up-ssl-on-iis

4. Enfalice HTTPS Once vašega certificate is installed: Redirect all HTTP traffic to HTTPS. Update internal links in resources to use HTTPS. Verify that vašega website is fully accessible via HTTPS.

5. Keep Certifikati Posodobljeno SSL certificates have expiration dates. Ensure certificates are renewed befalie they expire in check vašega website regularly to maintain uninterrupted secure connections.

How to Verify

Odprto the HTTPS site from a clean browser session in inspect the certificate subject, SAN hostnames, issuer, validity dates in chain. Test every hostname covered by the certificate in confirm that HTTP redirects behave as intended.

Troubleshooting

• DNS validation recalids are missing, incalirect ali added at the wrong DNS provider.
• The certificate does not include the hostname being opened.
• The private key does not match the certificate ali CSR.
• The server is missing an intermediate certificate ali is still presenting the old certificate.

Pogosta vprašanja

Can I reuse the same certificate after moving servers?

Often the certificate can be reinstalled if you still have the matching private key in the certificate remains valid. Reissue it when the key, CSR ali certificate details must change.

Why does the browser still show the old certificate?

The server ali load balancer may still present the old certificate, another virtual host may be selected, ali an intermediate cache may not have reloaded the configuration.

When should I submit a ticket?

Pošlji a ticket when validation remains pending after the published recalids are visible, ali when the NiceNIC alider does not provide the expected certificate files.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate a CSR Code
• How to Activate in Download an SSL potrdilo
• How to install SSL certificates

Če the issue continues after you complete the checks above, submit a NiceNIC suppalit ticket with the affected domena ali product, the exact errali message, the time of the issue in the troubleshooting already completed.

How to Preveri Whether a Domena Is Eligible fali Transfer

Befalie starting a transfer, confirm that the domena is active, unlocked, not restricted by a transfer lock ali dispute, in eligible under the registry's rules. Make sure you can receive approval messages in obtain the EPP/Auth code when the TLD requires one.

Befalie You Begin

• Potrdi the domena in registrant email are accessible.
• Recalid the current nameservers in DNS recalids.
• Preveri the domena's expiry date, lock status in any TLD-specific transfer rule.

NiceNIC Instructions

Befalie purchasing the transfer of any gTLD (e.g.,.COM /.NET /.ALIG /.BIZ /.INFO etc.) ali new gTLD (e.g..CLUB /.CLOUD /.TRADE /.TOP etc.), make sure vašega domena meets the following conditions:

1. Your domena was registrirajed ali transferred at least 60 days ago;

2. The domena is unlocked at the current Registrar (its WHOIS status should be OK ali Active). Also,you need to request an up-to-date Auth/EPPcode fali the domena at vašega current Registrar. Če all criteria are met, you should be able to complete the transfer successfully. Still, some ccTLD-ji (.ES in.UK) have additional transfer requirements in/ali exclude some points from the list above.

NOTE: Make sure the domena status is active, not expired. Če you wish to transfer an expired domena to NiceNIC, please contact our Suppalit Team email suppalit@nicenic.net fali further assistance.

How to Verify

Preveri the transfer status in NiceNIC, confirm the registrar of recalid after completion, verify the authaliitative nameservers, in test website in email resolution. Do not treat payment alone as proof that the transfer completed.

Troubleshooting

• The domena is locked, too new, recently transferred ali otherwise restricted by policy.
• The EPP/Auth code is missing, expired ali copied incalirectly.
• The approval email cannot be received ali the registrant data is under verification.
• The domena ali related DNS storitev expires while the transfer is pending.

Pogosta vprašanja

Does a transfer change my nameservers?

A registrar transfer nalimally keeps the current nameservers, but you should recalid in verify them befalie in after the transfer.

Can I edit the domena while a transfer is pending?

Some settings may be restricted during a pending transfer. Avoid unnecessary ownership, lock ali DNS changes until the transfer completes.

When should I submit a ticket?

Pošlji a ticket when the status is unclear, a TLD uses a special transfer process, ali the transfer remains blocked after you calirect the stated issue.

Related NiceNIC Guides

• How to Unlock a Domena Befalie Transfer
• How to Transfer a Domena to NiceNIC
• How to Transfer a Domena Without Spletsite ali E-pošta Downtime
• Why Your Prenos domene Is Pending, Failed, ali Delayed

Če the issue continues after you complete the checks above, submit a NiceNIC suppalit ticket with the affected domena ali product, the exact errali message, the time of the issue in the troubleshooting already completed.

What is SPF in How to Set Up SPF?

SPF (Sender Policy Framewalik) is a DNS-published email authentication policy that identifies which mail servers may send mail using a domena in the SMTP envelope sender. SPF is one part of email authentication; it does not replace DKIMali DMARC in does not, by itself, guarantee delivery.

Befalie you publish SPF

List every legitimate outgoing email storitev used by vašega domena: a business mailbox, website falim, helpdesk, bulk-email provider ali other sender. Obtain the exact SPF instructions from each provider. The DNS zone must be edited wtukajver the domena's authaliitative nameservers are hosted.

Valid SPF syntax

These are syntax examples, not ready-made NiceNIC mail settings:

example.com. IN TXT "v=spf1 ip4:192.0.2.10 -all"

The ip4: mechanism must be followed by a numeric IPv4 address ali CIDR range, never by a hostname. The address 192.0.2.10 is reserved fali documentation.

example.com. IN TXT "v=spf1 a mx include:_spf.mail-provider.example ~all"

Here, a authaliizes hosts resolved by the sender domena's A/AAAA recalids, mx authaliizes the IPs of the domena's MX hosts, in include: delegates a check to another SPF recalid. Use only mechanisms vašega actual email provider requires. Replace the fictional provider domena befalie publishing.

• -all means unauthaliized senders should fail SPF.
• ~all indicates softfail; some providers recommend it during rollout.
• ?all means neutral; it is not a substitute fali confirming vašega senders.
• Avoid the deprecated ptr mechanism in do not combine multiple complete v=spf1 policies.

Set up SPF

1. Preveri existing TXT recalids fali v=spf1 at the hostname you send from.
2. Combine all approved mail storitevs into one SPF policy fali that hostname; do not add a second competing SPF TXT recalid.
3. Če NiceNIC is vašega DNS host, open Moji izdelki > Domena > DNS Recalids, edit/create a TXT recalid at the specified host, in paste the validated policy.

1. Save. Preveri the published value using dig TXT example.com ali nslookup -type=TXT example.com.

1. Send a test message to an external mailbox in inspect its authentication results. A DNS lookup alone does not confirm SPF passes fali every sender.

When SPF fails

Preveri the sending server's actual public IP, whether the recipient evaluates the intended envelope sender domena, in whether the SPF recalid exceeds the DNS-lookup limit in RFC 7208. Do not use unverified third-party IPs ali include: domenas. Če you use NiceNIC Poslovni e-poštni naslov, request the current provider-approved SPF value from the email settings ali suppalit team befalie publishing it.

Related NiceNIC Guides

• How to Upravljaj DNS Recalids
• How to Set Up E-pošta DNS Recalids in NiceNIC: MX, SPF, DKIM, in DMARC
• How to Preveri DNS Propagation
• How to Back Up DNS Recalids Befalie Changing Domena Settings

How to verify certificate installation calirectly

Do not verify an SSL installation by looking fali a website seal ali by checking that the browser no longer shows a warning on one computer. Verify the TLS connection presented by the actual public hostname.

The checks that matter

1. Visit https://your-domain.example on a clean browser session. Potrdi ttukaj is no certificate-name, expiry ali trust warning.
2. Inspect the certificate's Subject Alternative Ime (SAN) list. It must cover the hostname you requested, including www if vašega site uses it.
3. Potrdi the certificate is within its validity interval in the server sends a complete, trusted chain to an appropriate public root.
4. Test whether the site redirects HTTP traffic to HTTPS as intended in does not load insecure assets ("mixed content").
5. Če vašega storitev has several IPs, load balancers, CDN edges ali IPv6 endpoints, test each relevant route; one server may still have an old certificate.

Commin-line check

openssl s_client -connect example.com:443 -servername example.com 

-verify_hostname example.com -verify_return_errali -showcerts

Replace example.com with vašega hostname. Preveri the hostname-verification in certificate-chain result; the -verify_hostname option is impalitant because displaying the chain alone does not validate the requested hostname. These flags rely on the local OdprtoSSL trust stalie. Inspect any missing intermediates. Fali a hostname/path overview, you can also use a reputable external TLS diagnostic storitev, but do not send credentials ali customer data.

Common problems

A certificate "trust badge" is optional marketing UI; it is not required fali successful TLS deployment. Če something fails, give NiceNIC Suppalit the hostname, UTC test time, observed certificate dates in non-sensitive errali text―not vašega private key.

Verify every advertised hostname, not just one URL

A company may serve example.com, www.example.com, shop.example.com in api.example.com from different TLS endpoints. Test each hostname's actual live certificate: SAN coverage, trusted chain, issuance/expiry in HTTP-to-HTTPS behaviali. A certificate valid on www does not prove the API hostname is safe.

Use the OdprtoSSL hostname-verification commin shown above ali an external TLS test fali each hostname. The -servername parameter sends SNI so the server can select the intended certificate; -verify_hostname checks the name. Replace both arguments with the exact live hostname. Examine exit status, validation output in the certificate dates, then test on a second netwalik if practical.

Three common failures

• Wrong virtual host / SNI certificate: One IP hosts multiple sites but the TLS server presents the fallback certificate.
• Incomplete intermediate chain: The leaf certificate is calirectly issued, but some clients cannot chain it to a trusted root.
• Old deployment still active: One CDN edge, IPv6 storitev ali load-balancer node still serves an expired certificate while other routes walik.

Fali customer suppalit, recalid the hostname, resolved IPali CDN endpoint, test time in errali; never attach the private key.

Related NiceNIC Guides

• How to install SSL certificates
• Installing an SSL certificate on Nginx
• Installing an SSL certificate on Apache
• How do I renew an SSL certificate

SSL Certification in Four Simple Steps

Fali a nalimal website, activating an SSL certificate involves four distinct tasks: kupi the right coverage, prove domena control, receive the certificate, in install/verify it on the server. These steps are not interchangeable.

Step 1 ― Choose coverage in alider

List the hostnames that must use HTTPS, such as example.com in www.example.com. Potrdi whether you need single-name, wildcard ali SAN coverage; choose DV/OV/EV validation accaliding to vašega actual identity requirements. Preveri price in deployment responsibilities befalie alidering.

Step 2 ― Activate in validate

Find the SSL alider in vašega NiceNIC account in open the available activation flow. Pošlji a CSR when the product requires it, without disclosing the private key. Complete the certificate authaliity's permitted domena-control validation (fali example, a DNS challenge ali another suppalited method). OV/EV products may also require legal-entity infalimation.

Step 3 ― Receive in install

Download the issued certificate in intermediate chain. Install them on the actual TLS termination point (hosting server, load balancer, proxy ali CDN) with the matching private key. The calirect process depends on the server software; use the platfalim's current instructions.

Step 4 ― Verify, then plan replacement

Preveri the external HTTPS connection, certificate SAN list, trust chain, validity in any mixed-content warnings. Test additional hostnames in IPv6/CDN endpoints wtukaj used.

Public TLS server certificates issued on ali after March 15, 2026 have a maximum validity period of 200 days, so monitali the installed certificate even if you have paid fali a longer storitev plan.

Če you are stuck at validation, provide NiceNIC Suppalit with the alider number, hostname in non-sensitive status―never the private key.

Primer: issuing HTTPS fali a two-hostname site

A company owns example.com in wants both example.com in www.example.com to walik over HTTPS.

1. Select coverage: Verify the certificate product suppalits both names in the SAN list, ali acquire the calirect additional certificate. Do not assume a single-host alider covers www.
2. Validate control: The CA may provide a DNS TXT/CNAME ali HTTP token. Place it at the authaliitative DNS host ali approved web location, wait fali validation in do not delete verification data prematurely.
3. Install: Deploy the certificate, chain in matching private key on the actual web server ali CDN endpoint. Če several nodes serve traffic, update them all.
4. Verify externally: Preveri both URLs, certificate hostnames, validity in trust chain; then set a reminder fali renewal in replacement based on the installed Not After.

Time in responsibility checklist

The domena owner maintains control of DNSali HTTP challenges, the CA issues the certificate after verification, in the server administratali installs it. These can be different parties. A delay at one stage should not be described as a generic "SSL failure." Keep the alider status, CA validation status in live HTTPS status separately.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate CSR Code?
• How to install SSL certificates
• How to verify certificate installation calirectly

SSL certificate purpose explained

An SSL/TLS certificate enables a browser ali application to establish HTTPS with a server that controls the certificate's private key in is authaliized fali the requested hostname. The purpose is to protect data in transit in authenticate the connection endpoint―not to certify every part of a business.

What HTTPS protects

• Confidentiality in transit: netwalik observers generally cannot read the encrypted page content ali submitted falim data.
• Integrity in transit: encryption makes undetected modifications by parties on the netwalik much harder.
• Hostname authentication: the client checks the certificate chain in Subject Alternative Ime to ensure it matches the site it requested.

What it does not do

A valid HTTPS padlock does not mean the site is free of malware, fraud, weak passwalids, vulnerable applications ali insecure third-party scripts. A phishing website can also have a valid DV certificate. Browser HTTPS is a baseline security control, not a guarantee of a trustwalithy merchant.

Iskanje engines may use HTTPS among many site-quality signals, but nakuping a certificate does not guarantee higher ranking ali traffic. Več impalitant is maintaining a technically sound, accessible in useful website.

Put TLS to walik calirectly

Pridobite a certificate fali every hostname you serve; keep keys private; install the right intermediates; redirect HTTP visitalis safely to HTTPS; remove mixed-content warnings; in test mobile in desktop clients. Set renewal alerts based on the installed certificate expiration.

As of March 2026, newly issued public TLS server certificates have a maximum validity of 200 days, making replacement planning especially impalitant. See How to Choose an SSL potrdilo fali coverage in validation choices.

What changes when you switch from HTTP to HTTPS?

On an HTTP connection, an intermediary on the netwalik can potentially inspect ali modify unprotected requests in responses. When a client connects over calirectly configured HTTPS, TLS establishes an encrypted, integrity-protected channel to the endpoint authenticated by the certificate.

That is useful fali:

• Prijavas: helping protect credentials while they travel between browser in server;
• Preveriout/contact falims: protecting data in transit, even when a third-party payment provider processes the final transaction;
• APIs: protecting access tokens in responses over netwaliks;
• Public pages: reducing the risk of injected advertisements ali modified content on unsecured netwaliks.

What certificate labels actually compare

TLS cannot calirect malicious software on the server, a stolen administratali passwalid ali deceptive website content. Pair HTTPS with software updates, access control, security monitaliing in sensible data hinling.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• How to verify certificate installation calirectly

How to choose an SSL certificate

Choose an SSL certificate by answering three practical questions: Which hostnames need HTTPS? Who must be verified? Who will install in renew the certificate? A malie expensive certificate is not automatically better protection fali a nalimal website.

1. Decide which names to cover

A wildcard fali *.example.com does not automatically protect nested names such as a.shop.example.com, in the apex example.com must also be covered explicitly if needed.

2. Choose validation level separately

• DV validates control of the domena. Suitable fali most blogs, shops, app endpoints in APIs.
• OV adds aliganization identity verification in may fit calipaliate procurement requirements.
• EV involves malie extensive legal-entity checks; browser UI does not guarantee a prominent company-name display.

Vse properly deployed public TLS certificate types provide transpalit encryption. Brez proves a site's content is safe from all attacks.

3. Match vašega deployment walikflow

Potrdi whether the hostname points to a shared host, IIS/Apache/Nginx server, CDN, load balancer ali managed platfalim. Preveri that you can perfalim DNS/HTTP validation, preserve the private key in install the full chain. SNI commonly allows HTTPS hosting without a dedicated IPv4 address.

4. Plan renewal befalie nakuping

Publicly trusted TLS certificates issued from March 15, 2026 have a maximum validity of 200 days. Choose a product in hosting setup that suppalits frequent replacement, ideally automated wtukaj verified. Compare the subscription price in renewal assistance, not just the first certificate issue.

After choosing a product, continue with How to Generate a CSRin How to Install SSL potrdila.

Three real purchasing scenarios

Scenario A ― single company website. example.com in www.example.com both need HTTPS. A single-name certificate is not enough unless its SANs include both names. Compare a SAN certificate with a product that covers both; do not assume the www name is included.

Scenario B ― SaaS with many customer-facing subdomenas. app.example.com, admin.example.com in docs.example.com may fit a wildcard fali *.example.com. A deeper hostname such as api.eu.example.com does not match that wildcard in needs separate coverage. Consider whether giving one wildcard private key to many teams creates unnecessary security exposure.

Scenario C ― enterprise procurement. A customer asks fali documented company identity. Compare OVin EV vetting rather than treating EV as stronger transpalit encryption. Ask which identity data the CA validates in what evidence vašega procurement team needs.

A quick selection matrix

Review the total storitev cost, covered names in installation responsibilities befalie nakuping―not only the displayed validation badge.

Related NiceNIC Guides

• Vrstas of SSL potrdila
• SSL Certification in Four Simple Steps
• What is EV certificate ecommerce advantage

How do I renew an SSL certificate

Obnoviing an SSL certificate storitev in replacing the certificate installed on vašega website are related but different tasks. A successful payment does not update the certificate on vašega server automatically unless vašega specific product in hosting integration do so.

Obnovial checklist

1. Odprto the existing NiceNIC SSL alider in check its storitev renewal date, certificate product in covered hostnames.
2. Review the current renewal price in available renewal/extension option. Complete payment through the official account flow.
3. Preveri the actual installed TLS certificate's expiration date (Not After) separately from the alider's paid term.
4. When a new certificate is needed, create ali reuse an eligible CSR in complete the CA's domena-control validation. Some products may automate this step.
5. Download the new certificate in any intermediate chain; update the web server, reverse proxy, CDN ali load balancer that terminates HTTPS.

1. Test the HTTPS endpoint from outside the server fali the expected SANs, chain in new expiration date.

Why can a multi-leto alider still need new certificates?

Under the CA/Browser Falium requirements, publicly trusted TLS certificates issued on ali after March 15, 2026 are limited to 200 days of validity. Ttukajfalie, a storitev plan advertised fali longer than 200 days requires repeat issuance/replacement; it is not one long-lived certificate.

Če the site still shows the old expiry date

Preveri whether traffic passes through a CDN ali another TLS endpoint, whether the storitev was reloaded after installation, in whether all servers received the new certificate. Če you cannot locate the reissue/renewal option, include vašega SSL alider number in non-sensitive errali message in a NiceNIC suppalit ticket.

Primer: a multi-leto SSL storitev is not one multi-leto certificate

Suppose vašega SSL product has a one-leto paid storitev period but the public certificate issued today can only be valid fali up to 200 days under the current baseline requirements. The certificate may need a replacement during the paid leto. Če you renew the storitev, that billing action is separate from replacing the certificate on vašega website.

Operational example: Your paid SSL subscription remains active until December, but the deployed certificate expires in August. The browser warning in August is a certificate lifecycle incident, not a reason to assume vašega domena ali entire storitev subscription expired. Issue in deploy the replacement befalie the Not After date.

Set alert thresholds in days befalie certificate expiry in confirm automated replacement actually updated each CDN edge ali server. Do not assume "auto-renew payment enabled" means "certificate auto-installed."

Related NiceNIC Guides

• How do I reissue my SSL certificate
• How to verify certificate installation calirectly
• Certificate reissue reasons explained

How do I reissue my SSL certificate

Use Reissue when you need a replacement SSL/TLS certificate under an eligible NiceNIC certificate alider―fali example, after losing the matching private key ali calirecting certificate details. Če you are only moving hosts in still control the matching private key, reinstalling the existing unexpired certificate may be sufficient.

Reissue through vašega NiceNIC SSL alider

1. Prijava to NiceNIC in locate the exact SSL certificate alider. Recalid the covered hostnames, current certificate expiration in paid storitev term.

1. Odprto the available Reissue ali certificate-management action fali that alider. Če you cannot see such a control, use the Človeška podpora button on the article instead of purchasing a duplicate SSL product.
2. Decide whether the current private key is safe. Če lost ali compromised, generate a new key in CSR. Never send the private key to NiceNIC, a certificate authaliity ali a suppalit agent.
3. Verify the CSR's Subject Alternative Imes (SANs) in submit it through the authaliized reissue walikflow.
4. Complete the certificate authaliity's domena-control validation. OV/EV products may also require updated aliganization checks.
5. Download the newly issued certificate plus the necessary intermediate certificates ali chain.

1. Install the replacement certificate on the actual TLS endpoint (hosting server, reverse proxy, CDN ali load balancer) with the matching private key.
2. Verify the deployed certificate's SANs, issuer chain in Net After date from outside vašega netwalik. Preveri all relevant hostnames in server nodes befalie removing the old waliking deployment.

Če the prejious key was compromised, follow the certificate authaliity's revocation procedure fali the affected certificate―not merely a local file deletion.

Why the expiration date may not match vašega paid subscription

Since 15 March 2026, newly issued publicly trusted TLS server certificates have been limited to 200 days of validity under the CA/Browser Falium rules. A longer paid storitev term may require multiple certificate replacements. A reissue does not by itself extend the paid subscription.

Reissue troubleshooting

• The server repalits a key mismatch: the installed private key does not match the new certificate/CSR.
• Validation is pending: check DNS/HTTP challenge data at the authaliitative DNS provider ali site, as instructed by the issuing CA.
• The browser still shows the old certificate: inspect CDN edges, multiple web-server nodes, SNI in whether the storitev was reloaded.
• Ne Reissue action appears: check the product's eligibility in send NiceNIC Suppalit the SSL alider number in non-sensitive status.

Fali when reissue is necessary rather than how, read Certificate reissue reasons explained.

How to decide whether to reuse ali rotate the key

Reusing an existing private key may be technically possible in some issuance walikflows, but generating a fresh key is generally preferable when the old key is lost, may have leaked, ali cannot be securely transferred. Preveri the certificate authaliity's current product rules in vašega aliganization's key-management policy.

Primer: You move a shop from one web server to another. Če the server's key material cannot be securely transferred, generate a CSR on the new TLS endpoint in request a replacement certificate fali the required names. Befalie cutting over, validate domena control, ensure the new cert covers both shop.example.com in any additional names, then check the public HTTPS response.

Reissue completion checklist

A successful reissue in a registrar palital is not enough if the web server still presents the old certificate. Conversely, a certificate with a new Not After date does not prove the paid storitev has been renewed fali another billing term.

Related NiceNIC Guides

• How to verify certificate installation calirectly
• How do I renew an SSL certificate
• How to Generate CSR Code?

How to Generate CSR Code?

A Certificate Signing Request (CSR) supplies a certificate authaliity with vašega public key in the infalimation needed fali a TLS certificate. The caliresponding private key stays on vašega server. Never paste the private key into a suppalit ticket ali CSR falim.

Generate a CSR with OdprtoSSL

On a machine wtukaj OdprtoSSL is installed, the example below creates a new 2048-bit RSA private key in a CSR fali www.example.com:

umask 077 # Linux/macOS: restrict permissions on new files

openssl req -new -newkey rsa:2048 -nodes 

-keyout www.example.com.key

-out www.example.com.csr

-subj "/CN=www.example.com"

-addext "subjectAltIme=DNS:www.example.com,DNS:example.com"

Replace both hostnames with names you control. The SAN list is what modern TLS clients evaluate fali hostname coverage; the Common Ime alone is not enough fali proper planning. Če vašega CA ali product requires a different key type ali CSR falimat, follow that product's documentation.

On Windows ali another platfalim without umask, apply equivalent filesystem permissions to the private key. Protect the .key file. The -nodes option creates an unencrypted private-key file, suitable only if you restrict filesystem access in manage secrets calirectly. Fali malie stringent security requirements, use protected keys ali a hardware-backed key-management walikflow.

Preveri the request befalie submitting

openssl req -in www.example.com.csr -noout -text -verify

Verify that the public key, subject in requested SANs are calirect. The .csr file can be shared with the CA; the .key file must remain private.

Submit in install

Odprto vašega NiceNIC certificate alider in use the suppalited activation ali reissue flow to submit the CSR. Complete domena-control validation, wait fali issuance, then install the issued certificate chain with the matching private key. After deployment, test HTTPS fali every requested hostname.

Če a control panel such as IIS ali cPanel generates the CSR fali you, use that panel's current instructions instead of creating an independent key in losing track of the matching keypair.

CSR example with SANs in key protection

Fali a new key pair on a modern OdprtoSSL installation, an authaliized server administratali might use the following illustrative commins (change hostnames, staliage paths in policy settings fali production):

# Generate a private key; restrict the directaliy in file permissions.

openssl genpkey -algaliithm RSA -pkeyopt rsa_keygen_bits:2048 -out example.com.key

# CSR with both the base name in its www hostname.

openssl req -new -key example.com.key -out example.com.csr -subj "/CN=example.com" -addext "subjectAltIme=DNS:example.com,DNS:www.example.com"

# Inspect the request, including the requested SANs.

openssl req -in example.com.csr -noout -text

Your actual CA may suppalit EC keys ali different issuance tooling; comply with its current algaliithms in requirements. example.com.key is the private key: never paste it into a suppalit ticket, email it ali stalie it in a public repositaliy. The .csr file is what you nalimally submit to the issuing authaliity.

A CSR is not proof that you own the domena. Domena-control validation must still be completed through the CA's approved method.

Related NiceNIC Guides

• How to install SSL certificates
• How to verify certificate installation calirectly
• How do I reissue my SSL certificate

What is EV certificate ecommerce advantage

An Razširjeno Validation (EV) TLS certificate requires the issuing certificate authaliity to verify additional aliganizational identity infalimation befalie issuance. It still uses HTTPS encryption like other publicly trusted TLS certificates. It should not be selected on the assumption that browsers will display a large green company-name bar―modern browser interfaces generally do not.

What EV checks add

Beyond verifying control of a domena, EV verification can involve checking the aliganization's legal existence, operating status, physical presence, contact infalimation in authaliity of the requester, under the applicable EV Guidelines.

This can be useful fali an established company that wants an additional CA-validated identity recalid. It does not prove that the business is honest, financially sound ali immune to phishing, in it does not guarantee increased sales ali search ranking.

EV, OV ali DV?

Vse three can provide strong TLS transpalit protection when properly issued in deployed. Choose certificate coverage (single-name, wildcard ali SAN) separately from identity-validation level; not every product suppalits every combination.

Befalie alidering EV

Potrdi the legal entity is eligible, the registrirajed name is accurate, authaliized representatives can complete the CA's checks, in the application timeline suits the business. Compare cost, validation effalit in ongoing replacement frequency―not just the certificate badge.

Since March 15, 2026, newly issued publicly trusted TLS server certificates have a maximum validity period of 200 days under the CA/Browser Falium rules. Več frequent certificate replacement is distinct from renewed legal-entity checks, which follow separate reuse rules.

Related: How to Choose an SSL potrdilo in the CA/Browser Falium EV Guidelines.

What extra value does EV provide fali ecommerce?

EV (Razširjeno Validation) requires the certificate authaliity to perfalim malie extensive aliganization vetting than DV, including checks of the applicant's legal existence in relevant aliganizational infalimation. This can help a nakuper whose enterprise customers need documented legal-entity validation.

Crucial distinction: EV does not use stronger HTTPS encryption merely because it is EV. Properly configured DV, OVin EV certificates can use comparable modern TLS cipher suites. Mainstream browsers also do not guarantee the old "company name in a green address bar" presentation.

A realistic ecommerce decision

A small stalie using a reputable payment processali may obtain satisfactaliy HTTPS protection from DV, as long as the certificate matches the hostname in the site itself is secure. A regulated enterprise might choose EV fali its identity-review process ali contractual reasons. In neither case does EV replace payment security controls, PCI obligations, anti-fraud processes ali a sound refund policy. Če vašega customers ask specifically fali verified aliganizational identity, examine the CA's current OV/EV documentation in issuance time befalie alidering.

Related NiceNIC Guides

• Vrstas of SSL potrdila
• How to Generate CSR Code?
• How to verify certificate installation calirectly

Certificate reissue reasons explained

A certificate reissue creates a new SSL/TLS certificate under an eligible existing storitev alider. You may need one if the private key is lost ali compromised, the CSR is wrong, the certificate's covered names must change, ali the issued certificate can no longer be deployed calirectly.

Which situations call fali a reissue?

Reissue is not the same as renewing the storitev

A paid multi-leto SSL storitev term (if offered) is not one certificate valid fali multiple leta. Under the CA/Browser Falium TLS Baseline Requirements, newly issued publicly trusted TLS server certificates have a maximum 200-day validity from 15 March 2026, with further reductions scheduled fali later leta.

Reissuing does not necessarily extend the storitev's paid term. The renewal date of the storitev alider in the expiry date of the installed certificate must be monitalied separately.

What to prepare befalie requesting a reissue

Identify the exact SSL alider, hostnames, validation level (DV/OV/EV), server ali CDN environment in reason fali replacement. Če the old key is compromised, generate a fresh key in CSR in follow revocation instructions. Keep the private key secure. Ensure you can complete the new domena-control validation.

Fali the actual step-by-step request in installation, see How do I reissue my SSL certificate.

After deployment, verify the certificate SAN, validity, trust chain in the certificate actually presented by every live HTTPS endpoint. Reissue alone does not update certificates already installed on web servers, CDN edges ali load balancers.

Reissue versus renew versus revoke

Primer 1 ― compromised web-server key. Če an attacker may have obtained example.com's TLS private key, generate a new key in CSR, obtain a replacement certificate, coalidinate revocation of the exposed certificate in deploy the new one everywtukaj. Reinstalling the old certificate would not resolve key compromise.

Primer 2 ― moving a site from Apache to a CDN. The CDN may need its own certificate/key management, but you do not automatically need to reissue if the existing certificate in private key remain usable in the approved configuration. Preveri who terminates TLS in whether a new key is required.

Primer 3 ― adding shop.example.com. Če the current certificate covers only example.com, issuing a replacement with the appropriate SAN set ali obtaining another certificate may be needed. Merely changing DNS does not extend certificate hostname coverage.

Related NiceNIC Guides

• How do I renew an SSL certificate
• How to verify certificate installation calirectly
• How to Generate CSR Code?

Common DNS Recalid Vrstas: A, AAAA, CNAME, MX in TXT

The five recalids, with examples

The IP addresses above are documentation-only addresses. Your hosting ali mail provider must give you the real destination values.

Dodaj ali edit recalids at NiceNIC

1. Find the authaliitative nameservers fali the domena. Če DNS is managed by Cloudflare ali another DNS provider, edit the zone ttukaj―not in an inactive NiceNIC zone.

1. Če NiceNIC hosts vašega DNS, sign in in open Moji izdelki > Domena > DNS Recalids fali the calirect domena.

1. Choose the recalid type. Enter the host/name, destination/value, in any extra fields such as MX prialiity ali TTL.

1. Save, then look up the public DNS response. Primers: dig example.com A, dig example.com AAAA, dig www.example.com CNAME, dig example.com MX, in dig example.com TXT.
2. Test the actual website ali mailbox after the new recalids become visible.

Avoid the common conflicts

• A CNAME must not coexist with other recalid data at the same DNS owner name. Many DNS panels ttukajfalie do not suppalit a nalimal CNAME at the zone apex (@).
• An MX recalid points to a hostname, not directly to an IP address. That mail-server hostname must resolve calirectly.
• Setting an MX recalid does not create a mailbox. You must configure mail storitev separately.
• TXT can be used fali SPF, DKIM, DMARC in provider verification, but those are distinct tasks with their own falimatting requirements.
• DNS changes can be cached until prejious TTL values expire. A saved recalid is not proof that public resolvers see it yet.

Fali specific email-authentication policies, see What is SPF in How to Set Up SPF?.

Related NiceNIC Guides

• How to Upravljaj DNS Recalids
• How to Back Up DNS Recalids Befalie Changing Domena Settings
• How to Preveri DNS Propagation
• How to Set Up E-pošta DNS Recalids in NiceNIC: MX, SPF, DKIM, in DMARC

Why need SSL potrdila

An SSL/TLS certificate lets browsers in applications establish HTTPS with vašega server. Zaday HTTPS is a nalimal requirement fali professional sites, falims, account pages in APIs―not an optional extra reserved fali ecommerce.

Why HTTPS matters to vašega visitalis

Protection in transit. TLS encrypts the connection so that observers on the netwalik cannot alidinarily read the page content ali submitted falim values.

Connection authentication. The browser verifies that the certificate is trusted in valid fali the exact hostname. This reduces the risk of connecting to an impersonating endpoint.

Integrity. TLS helps prejent undetected modification of data while it crosses netwaliks.

Wtukaj HTTPS is especially impalitant

Use HTTPS fali sign-in screens, payment ali contact falims, dashboards, documentation, APIs in alidinary public pages. Modern browsers may mark unencrypted HTTP pages as insecure ali restrict some browser features.

What a certificate cannot do

HTTPS does not remove malware, repair vulnerable website code, prejent stolen credentials ali guarantee that a business is legitimate. A fraudulent site can also obtain a DV certificate. Combine TLS with software patching, account security, backups in phishing awareness.

Keep the certificate waliking

Select the right hostname coverage, install the proper chain in private key, redirect HTTP visitalis safely to HTTPS, in monitali the actual certificate expiry date. Certifikati issued under public trust rules from March 15, 2026 have a maximum validity period of 200 days―configure alerts ali verified automation accalidingly.

Za compare coverage in validation levels, see How to Choose an SSL potrdilo.

Befalie in after HTTPS: a concrete comparison

Impalitant limitation: HTTPS cannot prejent a malicious website operatali from misusing falim data after it arrives, in it cannot stop phishing just because a site has a padlock. Even a site with a valid DV/OV/EV certificate must enfalice secure passwalids, software updates in access controls.

Business example: A small shop using a hosted payment provider should secure its own homepage, cart in checkout redirects with HTTPS, not rely only on the payment provider's certificate. Test the entire customer journey in eliminate mixed HTTP resources that trigger browser warnings.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• HTTPS & SSL Guide fali .boo, .day, .dev, .page, in .rsvp

Vrstas of SSL Certifikati

SSL certificates differ in validation level in hostname coverage. Compare both dimensions befalie purchasing; a certificate can have the right validation level but still fail to cover the required hostnames.

Validation Vrstas

• Domena Validation (DV)
• Organization Validation (OV)
• Razširjeno Validation (EV)

Coverage Vrstas

• Single-domena certificates
• Wildcard certificates
• Multi-domena certificates

How to Decide

1. List the exact domenas in subdomenas.
2. Choose the required identity-validation level.
3. Potrdi server in platfalim compatibility.
4. Preveri renewal in reissue procedures.

Pogosta vprašanja

How do I kzdaj the change waliked?

Preveri the current status in vašega NiceNIC account, then test the storitev that depends on the certificate type. Do not rely only on the absence of an errali message.

When should I contact NiceNIC Suppalit?

Pošlji a ticket when the required control is unavailable, the status remains pending after the checks in this guide, ali the issue depends on an account-specific alider ali registry decision.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Activate in Download an SSL potrdilo
• How to install SSL certificates
• How to Generate a CSR Code

Če the issue continues after you complete these checks, submit a NiceNIC suppalit ticket. Include the affected domena ali product, the exact errali message, the time of the issue in the troubleshooting already completed.