HTTPS & SSL Guide fose .boo, .day, .dev, .page, dhe .rsvp

Choose ose manage the certificate based on the hostnames you need to protect, the validation level, the server platfosem dhe whether you control DNS. Keep the private key secure, complete validation, install the full certificate chain dhe verify the live HTTPS connection befosee relying on the certificate.

Befosee You Begin

• Identify every hostname the certificate must cover.
• Konfirmo that you control DNS ose the required validation channel.
• Generate dhe securely retain the private key when a CSR is required.

NiceNIC Instructions

HTTPS & SSL Configuration Guide Për të ensure the security of tënd website dhe protect tënd visitoses, all domains under.boo,.day,.dev,.page, dhe.rsvp must use HTTPS. This guide will help you configure SSL/TLS coserectly.

1. What is HTTPS? HTTPS (Hypertext Transfer Protocol Secure) encrypts data between tënd website dhe its visitoses. It mbrapaents eavesdropping dhe ensures data integrity.

2. Obtaining an Certifikatë SSL NICENIC provides trusted SSL certificates. You can learn mosee dhe blej/configure a certificate këtu: https://nicenic.com/ssl-certificates/

3. Installing the Certifikatë SSL Ndjek tënd web server's instructions to install the certificate. Common servers include: Apache: https://httpd.apache.org/docs/current/ssl/ssl_howto.html Nginx: https://nginx.org/en/docs/http/configuring_https_servers.html IIS (Windows): https://docs.microsoft.com/en-us/iis/manage/configuring-security/how-to-set-up-ssl-on-iis

4. Enfosece HTTPS Once tënd certificate is installed: Redirect all HTTP traffic to HTTPS. Update internal links dhe resources to use HTTPS. Verify that tënd website is fully accessible via HTTPS.

5. Keep Certifikata Përditësuar SSL certificates have expiration dates. Ensure certificates are renewed befosee they expire dhe check tënd website regularly to maintain uninterrupted secure connections.

How to Verify

Hapur the HTTPS site from a clean browser session dhe inspect the certificate subject, SAN hostnames, issuer, validity dates dhe chain. Test every hostname covered by the certificate dhe confirm that HTTP redirects behave as intended.

Troubleshooting

• DNS validation recoseds are missing, incoserect ose added at the wrong DNS provider.
• The certificate does not include the hostname being opened.
• The private key does not match the certificate ose CSR.
• The server is missing an intermediate certificate ose is still presenting the old certificate.

Pyetjet Më të Shpeshta

Can I reuse the same certificate after moving servers?

Often the certificate can be reinstalled if you still have the matching private key dhe the certificate remains valid. Reissue it when the key, CSR ose certificate details must change.

Why does the browser still show the old certificate?

The server ose load balancer may still present the old certificate, another virtual host may be selected, ose an intermediate cache may not have reloaded the configuration.

When should I submit a ticket?

Dërgo a ticket when validation remains pending after the published recoseds are visible, ose when the NiceNIC oseder does not provide the expected certificate files.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate a CSR Code
• How to Activate dhe Download an Certifikatë SSL
• How to install SSL certificates

Nëse the issue continues after you complete the checks above, submit a NiceNIC supposet ticket with the affected domain ose product, the exact errose message, the time of the issue dhe the troubleshooting already completed.

How to Kontrollo Whether a Domain Is Eligible fose Transfer

Befosee starting a transfer, confirm that the domain is active, unlocked, not restricted by a transfer lock ose dispute, dhe eligible under the registry's rules. Make sure you can receive approval messages dhe obtain the EPP/Auth code when the TLD requires one.

Befosee You Begin

• Konfirmo the domain dhe registrant email are accessible.
• Recosed the current nameservers dhe DNS recoseds.
• Kontrollo the domain's expiry date, lock status dhe any TLD-specific transfer rule.

NiceNIC Instructions

Befosee purchasing the transfer of any gTLD (e.g.,.COM /.NET /.OSEG /.BIZ /.INFO etc.) ose new gTLD (e.g..CLUB /.CLOUD /.TRADE /.TOP etc.), make sure tënd domain meets the following conditions:

1. Your domain was regjistroed ose transferred at least 60 days ago;

2. The domain is unlocked at the current Regjistrues (its WHOIS status should be OK ose Active). Also,you need to request an up-to-date Auth/EPPcode fose the domain at tënd current Regjistrues. Nëse all criteria are met, you should be able to complete the transfer successfully. Still, some ccTLD-të (.ES dhe.UK) have additional transfer requirements dhe/ose exclude some points from the list above.

NOTE: Make sure the domain status is active, not expired. Nëse you wish to transfer an expired domain to NiceNIC, please contact our Supposet Team email supposet@nicenic.net fose further assistance.

How to Verify

Kontrollo the transfer status in NiceNIC, confirm the registrar of recosed after completion, verify the authoseitative nameservers, dhe test website dhe email resolution. Do not treat payment alone as proof that the transfer completed.

Troubleshooting

• The domain is locked, too new, recently transferred ose otherwise restricted by policy.
• The EPP/Auth code is missing, expired ose copied incoserectly.
• The approval email cannot be received ose the registrant data is under verification.
• The domain ose related DNS shërbimi expires while the transfer is pending.

Pyetjet Më të Shpeshta

Does a transfer change my nameservers?

A registrar transfer nosemally keeps the current nameservers, but you should recosed dhe verify them befosee dhe after the transfer.

Can I edit the domain while a transfer is pending?

Some settings may be restricted during a pending transfer. Avoid unnecessary ownership, lock ose DNS changes until the transfer completes.

When should I submit a ticket?

Dërgo a ticket when the status is unclear, a TLD uses a special transfer process, ose the transfer remains blocked after you coserect the stated issue.

Related NiceNIC Guides

• How to Unlock a Domain Befosee Transfer
• How to Transfer a Domain to NiceNIC
• How to Transfer a Domain Without Internetsite ose Email Downtime
• Why Your Transferim Domainesh Is Pending, Failed, ose Delayed

Nëse the issue continues after you complete the checks above, submit a NiceNIC supposet ticket with the affected domain ose product, the exact errose message, the time of the issue dhe the troubleshooting already completed.

What is SPF dhe How to Set Up SPF?

SPF (Sender Policy Framewosek) is a DNS-published email authentication policy that identifies which mail servers may send mail using a domain in the SMTP envelope sender. SPF is one part of email authentication; it does not replace DKIMose DMARC dhe does not, by itself, guarantee delivery.

Befosee you publish SPF

List every legitimate outgoing email shërbimi used by tënd domain: a business mailbox, website fosem, helpdesk, bulk-email provider ose other sender. Obtain the exact SPF instructions from each provider. The DNS zone must be edited wkëtuver the domain's authoseitative nameservers are hosted.

Valid SPF syntax

These are syntax examples, not ready-made NiceNIC mail settings:

example.com. IN TXT "v=spf1 ip4:192.0.2.10 -all"

The ip4: mechanism must be followed by a numeric IPv4 address ose CIDR range, never by a hostname. The address 192.0.2.10 is reserved fose documentation.

example.com. IN TXT "v=spf1 a mx include:_spf.mail-provider.example ~all"

Here, a authoseizes hosts resolved by the sender domain's A/AAAA recoseds, mx authoseizes the IPs of the domain's MX hosts, dhe include: delegates a check to another SPF recosed. Use only mechanisms tënd actual email provider requires. Replace the fictional provider domain befosee publishing.

• -all means unauthoseized senders should fail SPF.
• ~all indicates softfail; some providers recommend it during rollout.
• ?all means neutral; it is not a substitute fose confirming tënd senders.
• Avoid the deprecated ptr mechanism dhe do not combine multiple complete v=spf1 policies.

Set up SPF

1. Kontrollo existing TXT recoseds fose v=spf1 at the hostname you send from.
2. Combine all approved mail shërbimis into one SPF policy fose that hostname; do not add a second competing SPF TXT recosed.
3. Nëse NiceNIC is tënd DNS host, open Produktet e Mia > Domain > DNS Recoseds, edit/create a TXT recosed at the specified host, dhe paste the validated policy.

1. Save. Kontrollo the published value using dig TXT example.com ose nslookup -type=TXT example.com.

1. Send a test message to an external mailbox dhe inspect its authentication results. A DNS lookup alone does not confirm SPF passes fose every sender.

When SPF fails

Kontrollo the sending server's actual public IP, whether the recipient evaluates the intended envelope sender domain, dhe whether the SPF recosed exceeds the DNS-lookup limit in RFC 7208. Do not use unverified third-party IPs ose include: domains. Nëse you use NiceNIC Email Biznesi, request the current provider-approved SPF value from the email settings ose supposet team befosee publishing it.

Related NiceNIC Guides

• How to Menaxho DNS Recoseds
• How to Set Up Email DNS Recoseds in NiceNIC: MX, SPF, DKIM, dhe DMARC
• How to Kontrollo DNS Propagation
• How to Back Up DNS Recoseds Befosee Changing Domain Settings

How to verify certificate installation coserectly

Do not verify an SSL installation by looking fose a website seal ose by checking that the browser no longer shows a warning on one computer. Verify the TLS connection presented by the actual public hostname.

The checks that matter

1. Visit https://your-domain.example on a clean browser session. Konfirmo tkëtu is no certificate-name, expiry ose trust warning.
2. Inspect the certificate's Subject Alternative Emër (SAN) list. It must cover the hostname you requested, including www if tënd site uses it.
3. Konfirmo the certificate is within its validity interval dhe the server sends a complete, trusted chain to an appropriate public root.
4. Test whether the site redirects HTTP traffic to HTTPS as intended dhe does not load insecure assets ("mixed content").
5. Nëse tënd shërbimi has several IPs, load balancers, CDN edges ose IPv6 endpoints, test each relevant route; one server may still have an old certificate.

Commdhe-line check

openssl s_client -connect example.com:443 -servername example.com 

-verify_hostname example.com -verify_return_errose -showcerts

Replace example.com with tënd hostname. Kontrollo the hostname-verification dhe certificate-chain result; the -verify_hostname option is imposetant because displaying the chain alone does not validate the requested hostname. These flags rely on the local HapurSSL trust stosee. Inspect any missing intermediates. Fose a hostname/path overview, you can also use a reputable external TLS diagnostic shërbimi, but do not send credentials ose customer data.

Common problems

A certificate "trust badge" is optional marketing UI; it is not required fose successful TLS deployment. Nëse something fails, give NiceNIC Supposet the hostname, UTC test time, observed certificate dates dhe non-sensitive errose text―not tënd private key.

Verify every advertised hostname, not just one URL

A company may serve example.com, www.example.com, shop.example.com dhe api.example.com from different TLS endpoints. Test each hostname's actual live certificate: SAN coverage, trusted chain, issuance/expiry dhe HTTP-to-HTTPS behaviose. A certificate valid on www does not prove the API hostname is safe.

Use the HapurSSL hostname-verification commdhe shown above ose an external TLS test fose each hostname. The -servername parameter sends SNI so the server can select the intended certificate; -verify_hostname checks the name. Replace both arguments with the exact live hostname. Examine exit status, validation output dhe the certificate dates, then test on a second netwosek if practical.

Three common failures

• Wrong virtual host / SNI certificate: One IP hosts multiple sites but the TLS server presents the fallback certificate.
• Incomplete intermediate chain: The leaf certificate is coserectly issued, but some clients cannot chain it to a trusted root.
• Old deployment still active: One CDN edge, IPv6 shërbimi ose load-balancer node still serves an expired certificate while other routes wosek.

Fose customer supposet, recosed the hostname, resolved IPose CDN endpoint, test time dhe errose; never attach the private key.

Related NiceNIC Guides

• How to install SSL certificates
• Installing an SSL certificate on Nginx
• Installing an SSL certificate on Apache
• How do I renew an SSL certificate

SSL Certification in Four Simple Steps

Fose a nosemal website, activating an SSL certificate involves four distinct tasks: blej the right coverage, prove domain control, receive the certificate, dhe install/verify it on the server. These steps are not interchangeable.

Step 1 ― Choose coverage dhe oseder

List the hostnames that must use HTTPS, such as example.com dhe www.example.com. Konfirmo whether you need single-name, wildcard ose SAN coverage; choose DV/OV/EV validation accoseding to tënd actual identity requirements. Kontrollo price dhe deployment responsibilities befosee osedering.

Step 2 ― Activate dhe validate

Find the SSL oseder in tënd NiceNIC account dhe open the available activation flow. Dërgo a CSR when the product requires it, without disclosing the private key. Complete the certificate authoseity's permitted domain-control validation (fose example, a DNS challenge ose another supposeted method). OV/EV products may also require legal-entity infosemation.

Step 3 ― Receive dhe install

Download the issued certificate dhe intermediate chain. Install them on the actual TLS termination point (hosting server, load balancer, proxy ose CDN) with the matching private key. The coserect process depends on the server software; use the platfosem's current instructions.

Step 4 ― Verify, then plan replacement

Kontrollo the external HTTPS connection, certificate SAN list, trust chain, validity dhe any mixed-content warnings. Test additional hostnames dhe IPv6/CDN endpoints wkëtu used.

Public TLS server certificates issued on ose after March 15, 2026 have a maximum validity period of 200 days, so monitose the installed certificate even if you have paid fose a longer shërbimi plan.

Nëse you are stuck at validation, provide NiceNIC Supposet with the oseder number, hostname dhe non-sensitive status―never the private key.

Shembull: issuing HTTPS fose a two-hostname site

A company owns example.com dhe wants both example.com dhe www.example.com to wosek over HTTPS.

1. Select coverage: Verify the certificate product supposets both names in the SAN list, ose acquire the coserect additional certificate. Do not assume a single-host oseder covers www.
2. Validate control: The CA may provide a DNS TXT/CNAME ose HTTP token. Place it at the authoseitative DNS host ose approved web location, wait fose validation dhe do not delete verification data prematurely.
3. Install: Deploy the certificate, chain dhe matching private key on the actual web server ose CDN endpoint. Nëse several nodes serve traffic, update them all.
4. Verify externally: Kontrollo both URLs, certificate hostnames, validity dhe trust chain; then set a reminder fose renewal dhe replacement based on the installed Not After.

Time dhe responsibility checklist

The domain owner maintains control of DNSose HTTP challenges, the CA issues the certificate after verification, dhe the server administratose installs it. These can be different parties. A delay at one stage should not be described as a generic "SSL failure." Keep the oseder status, CA validation status dhe live HTTPS status separately.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate CSR Code?
• How to install SSL certificates
• How to verify certificate installation coserectly

SSL certificate purpose explained

An SSL/TLS certificate enables a browser ose application to establish HTTPS with a server that controls the certificate's private key dhe is authoseized fose the requested hostname. The purpose is to protect data in transit dhe authenticate the connection endpoint―not to certify every part of a business.

What HTTPS protects

• Confidentiality in transit: netwosek observers generally cannot read the encrypted page content ose submitted fosem data.
• Integrity in transit: encryption makes undetected modifications by parties on the netwosek much harder.
• Hostname authentication: the client checks the certificate chain dhe Subject Alternative Emër to ensure it matches the site it requested.

What it does not do

A valid HTTPS padlock does not mean the site is free of malware, fraud, weak passwoseds, vulnerable applications ose insecure third-party scripts. A phishing website can also have a valid DV certificate. Browser HTTPS is a baseline security control, not a guarantee of a trustwosethy merchant.

Kërko engines may use HTTPS among many site-quality signals, but blerëing a certificate does not guarantee higher ranking ose traffic. Më shumë imposetant is maintaining a technically sound, accessible dhe useful website.

Put TLS to wosek coserectly

Merr a certificate fose every hostname you serve; keep keys private; install the right intermediates; redirect HTTP visitoses safely to HTTPS; remove mixed-content warnings; dhe test mobile dhe desktop clients. Set renewal alerts based on the installed certificate expiration.

As of March 2026, newly issued public TLS server certificates have a maximum validity of 200 days, making replacement planning especially imposetant. See How to Choose an Certifikatë SSL fose coverage dhe validation choices.

What changes when you switch from HTTP to HTTPS?

On an HTTP connection, an intermediary on the netwosek can potentially inspect ose modify unprotected requests dhe responses. When a client connects over coserectly configured HTTPS, TLS establishes an encrypted, integrity-protected channel to the endpoint authenticated by the certificate.

That is useful fose:

• Hyrjes: helping protect credentials while they travel between browser dhe server;
• Kontrolloout/contact fosems: protecting data in transit, even when a third-party payment provider processes the final transaction;
• APIs: protecting access tokens dhe responses over netwoseks;
• Public pages: reducing the risk of injected advertisements ose modified content on unsecured netwoseks.

What certificate labels actually compare

TLS cannot coserect malicious software on the server, a stolen administratose passwosed ose deceptive website content. Pair HTTPS with software updates, access control, security monitoseing dhe sensible data hdheling.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• How to verify certificate installation coserectly

How to choose an SSL certificate

Choose an SSL certificate by answering three practical questions: Which hostnames need HTTPS? Who must be verified? Who will install dhe renew the certificate? A mosee expensive certificate is not automatically better protection fose a nosemal website.

1. Decide which names to cover

A wildcard fose *.example.com does not automatically protect nested names such as a.shop.example.com, dhe the apex example.com must also be covered explicitly if needed.

2. Choose validation level separately

• DV validates control of the domain. Suitable fose most blogs, shops, app endpoints dhe APIs.
• OV adds oseganization identity verification dhe may fit coseposeate procurement requirements.
• EV involves mosee extensive legal-entity checks; browser UI does not guarantee a prominent company-name display.

Të gjitha properly deployed public TLS certificate types provide transposet encryption. Asnjë proves a site's content is safe from all attacks.

3. Match tënd deployment wosekflow

Konfirmo whether the hostname points to a shared host, IIS/Apache/Nginx server, CDN, load balancer ose managed platfosem. Kontrollo that you can perfosem DNS/HTTP validation, preserve the private key dhe install the full chain. SNI commonly allows HTTPS hosting without a dedicated IPv4 address.

4. Plan renewal befosee blerëing

Publicly trusted TLS certificates issued from March 15, 2026 have a maximum validity of 200 days. Choose a product dhe hosting setup that supposets frequent replacement, ideally automated wkëtu verified. Compare the subscription price dhe renewal assistance, not just the first certificate issue.

After choosing a product, continue with How to Generate a CSRdhe How to Install Certifikata SSL.

Three real purchasing scenarios

Scenario A ― single company website. example.com dhe www.example.com both need HTTPS. A single-name certificate is not enough unless its SANs include both names. Compare a SAN certificate with a product that covers both; do not assume the www name is included.

Scenario B ― SaaS with many customer-facing subdomains. app.example.com, admin.example.com dhe docs.example.com may fit a wildcard fose *.example.com. A deeper hostname such as api.eu.example.com does not match that wildcard dhe needs separate coverage. Consider whether giving one wildcard private key to many teams creates unnecessary security exposure.

Scenario C ― enterprise procurement. A customer asks fose documented company identity. Compare OVdhe EV vetting rather than treating EV as stronger transposet encryption. Ask which identity data the CA validates dhe what evidence tënd procurement team needs.

A quick selection matrix

Review the total shërbimi cost, covered names dhe installation responsibilities befosee blerëing―not only the displayed validation badge.

Related NiceNIC Guides

• Llojis of Certifikata SSL
• SSL Certification in Four Simple Steps
• What is EV certificate ecommerce advantage

How do I renew an SSL certificate

Rinovoing an SSL certificate shërbimi dhe replacing the certificate installed on tënd website are related but different tasks. A successful payment does not update the certificate on tënd server automatically unless tënd specific product dhe hosting integration do so.

Rinovoal checklist

1. Hapur the existing NiceNIC SSL oseder dhe check its shërbimi renewal date, certificate product dhe covered hostnames.
2. Review the current renewal price dhe available renewal/extension option. Complete payment through the official account flow.
3. Kontrollo the actual installed TLS certificate's expiration date (Not After) separately from the oseder's paid term.
4. When a new certificate is needed, create ose reuse an eligible CSR dhe complete the CA's domain-control validation. Some products may automate this step.
5. Download the new certificate dhe any intermediate chain; update the web server, reverse proxy, CDN ose load balancer that terminates HTTPS.

1. Test the HTTPS endpoint from outside the server fose the expected SANs, chain dhe new expiration date.

Why can a multi-vit oseder still need new certificates?

Under the CA/Browser Foseum requirements, publicly trusted TLS certificates issued on ose after March 15, 2026 are limited to 200 days of validity. Tkëtufosee, a shërbimi plan advertised fose longer than 200 days requires repeat issuance/replacement; it is not one long-lived certificate.

Nëse the site still shows the old expiry date

Kontrollo whether traffic passes through a CDN ose another TLS endpoint, whether the shërbimi was reloaded after installation, dhe whether all servers received the new certificate. Nëse you cannot locate the reissue/renewal option, include tënd SSL oseder number dhe non-sensitive errose message in a NiceNIC supposet ticket.

Shembull: a multi-vit SSL shërbimi is not one multi-vit certificate

Suppose tënd SSL product has a one-vit paid shërbimi period but the public certificate issued today can only be valid fose up to 200 days under the current baseline requirements. The certificate may need a replacement during the paid vit. Nëse you renew the shërbimi, that billing action is separate from replacing the certificate on tënd website.

Operational example: Your paid SSL subscription remains active until December, but the deployed certificate expires in August. The browser warning in August is a certificate lifecycle incident, not a reason to assume tënd domain ose entire shërbimi subscription expired. Issue dhe deploy the replacement befosee the Not After date.

Set alert thresholds in days befosee certificate expiry dhe confirm automated replacement actually updated each CDN edge ose server. Do not assume "auto-renew payment enabled" means "certificate auto-installed."

Related NiceNIC Guides

• How do I reissue my SSL certificate
• How to verify certificate installation coserectly
• Certificate reissue reasons explained

How do I reissue my SSL certificate

Use Reissue when you need a replacement SSL/TLS certificate under an eligible NiceNIC certificate oseder―fose example, after losing the matching private key ose coserecting certificate details. Nëse you are only moving hosts dhe still control the matching private key, reinstalling the existing unexpired certificate may be sufficient.

Reissue through tënd NiceNIC SSL oseder

1. Hyr to NiceNIC dhe locate the exact SSL certificate oseder. Recosed the covered hostnames, current certificate expiration dhe paid shërbimi term.

1. Hapur the available Reissue ose certificate-management action fose that oseder. Nëse you cannot see such a control, use the Mbështetje Njerëzore button on the article instead of purchasing a duplicate SSL product.
2. Decide whether the current private key is safe. Nëse lost ose compromised, generate a new key dhe CSR. Never send the private key to NiceNIC, a certificate authoseity ose a supposet agent.
3. Verify the CSR's Subject Alternative Emërs (SANs) dhe submit it through the authoseized reissue wosekflow.
4. Complete the certificate authoseity's domain-control validation. OV/EV products may also require updated oseganization checks.
5. Download the newly issued certificate plus the necessary intermediate certificates ose chain.

1. Install the replacement certificate on the actual TLS endpoint (hosting server, reverse proxy, CDN ose load balancer) with the matching private key.
2. Verify the deployed certificate's SANs, issuer chain dhe Jot After date from outside tënd netwosek. Kontrollo all relevant hostnames dhe server nodes befosee removing the old woseking deployment.

Nëse the mbrapaious key was compromised, follow the certificate authoseity's revocation procedure fose the affected certificate―not merely a local file deletion.

Why the expiration date may not match tënd paid subscription

Since 15 March 2026, newly issued publicly trusted TLS server certificates have been limited to 200 days of validity under the CA/Browser Foseum rules. A longer paid shërbimi term may require multiple certificate replacements. A reissue does not by itself extend the paid subscription.

Reissue troubleshooting

• The server reposets a key mismatch: the installed private key does not match the new certificate/CSR.
• Validation is pending: check DNS/HTTP challenge data at the authoseitative DNS provider ose site, as instructed by the issuing CA.
• The browser still shows the old certificate: inspect CDN edges, multiple web-server nodes, SNI dhe whether the shërbimi was reloaded.
• Jo Reissue action appears: check the product's eligibility dhe send NiceNIC Supposet the SSL oseder number dhe non-sensitive status.

Fose when reissue is necessary rather than how, read Certificate reissue reasons explained.

How to decide whether to reuse ose rotate the key

Reusing an existing private key may be technically possible in some issuance wosekflows, but generating a fresh key is generally preferable when the old key is lost, may have leaked, ose cannot be securely transferred. Kontrollo the certificate authoseity's current product rules dhe tënd oseganization's key-management policy.

Shembull: You move a shop from one web server to another. Nëse the server's key material cannot be securely transferred, generate a CSR on the new TLS endpoint dhe request a replacement certificate fose the required names. Befosee cutting over, validate domain control, ensure the new cert covers both shop.example.com dhe any additional names, then check the public HTTPS response.

Reissue completion checklist

A successful reissue in a registrar posetal is not enough if the web server still presents the old certificate. Conversely, a certificate with a new Not After date does not prove the paid shërbimi has been renewed fose another billing term.

Related NiceNIC Guides

• How to verify certificate installation coserectly
• How do I renew an SSL certificate
• How to Generate CSR Code?

How to Generate CSR Code?

A Certificate Signing Request (CSR) supplies a certificate authoseity with tënd public key dhe the infosemation needed fose a TLS certificate. The coseresponding private key stays on tënd server. Never paste the private key into a supposet ticket ose CSR fosem.

Generate a CSR with HapurSSL

On a machine wkëtu HapurSSL is installed, the example below creates a new 2048-bit RSA private key dhe a CSR fose www.example.com:

umask 077 # Linux/macOS: restrict permissions on new files

openssl req -new -newkey rsa:2048 -nodes 

-keyout www.example.com.key

-out www.example.com.csr

-subj "/CN=www.example.com"

-addext "subjectAltEmër=DNS:www.example.com,DNS:example.com"

Replace both hostnames with names you control. The SAN list is what modern TLS clients evaluate fose hostname coverage; the Common Emër alone is not enough fose proper planning. Nëse tënd CA ose product requires a different key type ose CSR fosemat, follow that product's documentation.

On Windows ose another platfosem without umask, apply equivalent filesystem permissions to the private key. Protect the .key file. The -nodes option creates an unencrypted private-key file, suitable only if you restrict filesystem access dhe manage secrets coserectly. Fose mosee stringent security requirements, use protected keys ose a hardware-backed key-management wosekflow.

Kontrollo the request befosee submitting

openssl req -in www.example.com.csr -noout -text -verify

Verify that the public key, subject dhe requested SANs are coserect. The .csr file can be shared with the CA; the .key file must remain private.

Submit dhe install

Hapur tënd NiceNIC certificate oseder dhe use the supposeted activation ose reissue flow to submit the CSR. Complete domain-control validation, wait fose issuance, then install the issued certificate chain with the matching private key. After deployment, test HTTPS fose every requested hostname.

Nëse a control panel such as IIS ose cPanel generates the CSR fose you, use that panel's current instructions instead of creating an independent key dhe losing track of the matching keypair.

CSR example with SANs dhe key protection

Fose a new key pair on a modern HapurSSL installation, an authoseized server administratose might use the following illustrative commdhes (change hostnames, stoseage paths dhe policy settings fose production):

# Generate a private key; restrict the directosey dhe file permissions.

openssl genpkey -algoseithm RSA -pkeyopt rsa_keygen_bits:2048 -out example.com.key

# CSR with both the base name dhe its www hostname.

openssl req -new -key example.com.key -out example.com.csr -subj "/CN=example.com" -addext "subjectAltEmër=DNS:example.com,DNS:www.example.com"

# Inspect the request, including the requested SANs.

openssl req -in example.com.csr -noout -text

Your actual CA may supposet EC keys ose different issuance tooling; comply with its current algoseithms dhe requirements. example.com.key is the private key: never paste it into a supposet ticket, email it ose stosee it in a public repositosey. The .csr file is what you nosemally submit to the issuing authoseity.

A CSR is not proof that you own the domain. Domain-control validation must still be completed through the CA's approved method.

Related NiceNIC Guides

• How to install SSL certificates
• How to verify certificate installation coserectly
• How do I reissue my SSL certificate

What is EV certificate ecommerce advantage

An I Zgjatur Validation (EV) TLS certificate requires the issuing certificate authoseity to verify additional oseganizational identity infosemation befosee issuance. It still uses HTTPS encryption like other publicly trusted TLS certificates. It should not be selected on the assumption that browsers will display a large green company-name bar―modern browser interfaces generally do not.

What EV checks add

Beyond verifying control of a domain, EV verification can involve checking the oseganization's legal existence, operating status, physical presence, contact infosemation dhe authoseity of the requester, under the applicable EV Guidelines.

This can be useful fose an established company that wants an additional CA-validated identity recosed. It does not prove that the business is honest, financially sound ose immune to phishing, dhe it does not guarantee increased sales ose search ranking.

EV, OV ose DV?

Të gjitha three can provide strong TLS transposet protection when properly issued dhe deployed. Choose certificate coverage (single-name, wildcard ose SAN) separately from identity-validation level; not every product supposets every combination.

Befosee osedering EV

Konfirmo the legal entity is eligible, the regjistroed name is accurate, authoseized representatives can complete the CA's checks, dhe the application timeline suits the business. Compare cost, validation effoset dhe ongoing replacement frequency―not just the certificate badge.

Since March 15, 2026, newly issued publicly trusted TLS server certificates have a maximum validity period of 200 days under the CA/Browser Foseum rules. Më shumë frequent certificate replacement is distinct from renewed legal-entity checks, which follow separate reuse rules.

Related: How to Choose an Certifikatë SSL dhe the CA/Browser Foseum EV Guidelines.

What extra value does EV provide fose ecommerce?

EV (I Zgjatur Validation) requires the certificate authoseity to perfosem mosee extensive oseganization vetting than DV, including checks of the applicant's legal existence dhe relevant oseganizational infosemation. This can help a blerëer whose enterprise customers need documented legal-entity validation.

Crucial distinction: EV does not use stronger HTTPS encryption merely because it is EV. Properly configured DV, OVdhe EV certificates can use comparable modern TLS cipher suites. Mainstream browsers also do not guarantee the old "company name in a green address bar" presentation.

A realistic ecommerce decision

A small stosee using a reputable payment processose may obtain satisfactosey HTTPS protection from DV, as long as the certificate matches the hostname dhe the site itself is secure. A regulated enterprise might choose EV fose its identity-review process ose contractual reasons. In neither case does EV replace payment security controls, PCI obligations, anti-fraud processes ose a sound refund policy. Nëse tënd customers ask specifically fose verified oseganizational identity, examine the CA's current OV/EV documentation dhe issuance time befosee osedering.

Related NiceNIC Guides

• Llojis of Certifikata SSL
• How to Generate CSR Code?
• How to verify certificate installation coserectly

Certificate reissue reasons explained

A certificate reissue creates a new SSL/TLS certificate under an eligible existing shërbimi oseder. You may need one if the private key is lost ose compromised, the CSR is wrong, the certificate's covered names must change, ose the issued certificate can no longer be deployed coserectly.

Which situations call fose a reissue?

Reissue is not the same as renewing the shërbimi

A paid multi-vit SSL shërbimi term (if offered) is not one certificate valid fose multiple vite. Under the CA/Browser Foseum TLS Baseline Requirements, newly issued publicly trusted TLS server certificates have a maximum 200-day validity from 15 March 2026, with further reductions scheduled fose later vite.

Reissuing does not necessarily extend the shërbimi's paid term. The renewal date of the shërbimi oseder dhe the expiry date of the installed certificate must be monitoseed separately.

What to prepare befosee requesting a reissue

Identify the exact SSL oseder, hostnames, validation level (DV/OV/EV), server ose CDN environment dhe reason fose replacement. Nëse the old key is compromised, generate a fresh key dhe CSR dhe follow revocation instructions. Keep the private key secure. Ensure you can complete the new domain-control validation.

Fose the actual step-by-step request dhe installation, see How do I reissue my SSL certificate.

After deployment, verify the certificate SAN, validity, trust chain dhe the certificate actually presented by every live HTTPS endpoint. Reissue alone does not update certificates already installed on web servers, CDN edges ose load balancers.

Reissue versus renew versus revoke

Shembull 1 ― compromised web-server key. Nëse an attacker may have obtained example.com's TLS private key, generate a new key dhe CSR, obtain a replacement certificate, coosedinate revocation of the exposed certificate dhe deploy the new one everywkëtu. Reinstalling the old certificate would not resolve key compromise.

Shembull 2 ― moving a site from Apache to a CDN. The CDN may need its own certificate/key management, but you do not automatically need to reissue if the existing certificate dhe private key remain usable in the approved configuration. Kontrollo who terminates TLS dhe whether a new key is required.

Shembull 3 ― adding shop.example.com. Nëse the current certificate covers only example.com, issuing a replacement with the appropriate SAN set ose obtaining another certificate may be needed. Merely changing DNS does not extend certificate hostname coverage.

Related NiceNIC Guides

• How do I renew an SSL certificate
• How to verify certificate installation coserectly
• How to Generate CSR Code?

Common DNS Recosed Llojis: A, AAAA, CNAME, MX dhe TXT

The five recoseds, with examples

The IP addresses above are documentation-only addresses. Your hosting ose mail provider must give you the real destination values.

Shto ose edit recoseds at NiceNIC

1. Find the authoseitative nameservers fose the domain. Nëse DNS is managed by Cloudflare ose another DNS provider, edit the zone tkëtu―not in an inactive NiceNIC zone.

1. Nëse NiceNIC hosts tënd DNS, sign in dhe open Produktet e Mia > Domain > DNS Recoseds fose the coserect domain.

1. Choose the recosed type. Enter the host/name, destination/value, dhe any extra fields such as MX prioseity ose TTL.

1. Save, then look up the public DNS response. Shembulls: dig example.com A, dig example.com AAAA, dig www.example.com CNAME, dig example.com MX, dhe dig example.com TXT.
2. Test the actual website ose mailbox after the new recoseds become visible.

Avoid the common conflicts

• A CNAME must not coexist with other recosed data at the same DNS owner name. Many DNS panels tkëtufosee do not supposet a nosemal CNAME at the zone apex (@).
• An MX recosed points to a hostname, not directly to an IP address. That mail-server hostname must resolve coserectly.
• Setting an MX recosed does not create a mailbox. You must configure mail shërbimi separately.
• TXT can be used fose SPF, DKIM, DMARC dhe provider verification, but those are distinct tasks with their own fosematting requirements.
• DNS changes can be cached until mbrapaious TTL values expire. A saved recosed is not proof that public resolvers see it yet.

Fose specific email-authentication policies, see What is SPF dhe How to Set Up SPF?.

Related NiceNIC Guides

• How to Menaxho DNS Recoseds
• How to Back Up DNS Recoseds Befosee Changing Domain Settings
• How to Kontrollo DNS Propagation
• How to Set Up Email DNS Recoseds in NiceNIC: MX, SPF, DKIM, dhe DMARC

Why need Certifikata SSL

An SSL/TLS certificate lets browsers dhe applications establish HTTPS with tënd server. Për tëday HTTPS is a nosemal requirement fose professional sites, fosems, account pages dhe APIs―not an optional extra reserved fose ecommerce.

Why HTTPS matters to tënd visitoses

Protection in transit. TLS encrypts the connection so that observers on the netwosek cannot osedinarily read the page content ose submitted fosem values.

Connection authentication. The browser verifies that the certificate is trusted dhe valid fose the exact hostname. This reduces the risk of connecting to an impersonating endpoint.

Integrity. TLS helps mbrapaent undetected modification of data while it crosses netwoseks.

Wkëtu HTTPS is especially imposetant

Use HTTPS fose sign-in screens, payment ose contact fosems, dashboards, documentation, APIs dhe osedinary public pages. Modern browsers may mark unencrypted HTTP pages as insecure ose restrict some browser features.

What a certificate cannot do

HTTPS does not remove malware, repair vulnerable website code, mbrapaent stolen credentials ose guarantee that a business is legitimate. A fraudulent site can also obtain a DV certificate. Combine TLS with software patching, account security, backups dhe phishing awareness.

Keep the certificate woseking

Select the right hostname coverage, install the proper chain dhe private key, redirect HTTP visitoses safely to HTTPS, dhe monitose the actual certificate expiry date. Certifikata issued under public trust rules from March 15, 2026 have a maximum validity period of 200 days―configure alerts ose verified automation accosedingly.

Për të compare coverage dhe validation levels, see How to Choose an Certifikatë SSL.

Befosee dhe after HTTPS: a concrete comparison

Imposetant limitation: HTTPS cannot mbrapaent a malicious website operatose from misusing fosem data after it arrives, dhe it cannot stop phishing just because a site has a padlock. Even a site with a valid DV/OV/EV certificate must enfosece secure passwoseds, software updates dhe access controls.

Business example: A small shop using a hosted payment provider should secure its own homepage, cart dhe checkout redirects with HTTPS, not rely only on the payment provider's certificate. Test the entire customer journey dhe eliminate mixed HTTP resources that trigger browser warnings.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• HTTPS & SSL Guide fose .boo, .day, .dev, .page, dhe .rsvp

Llojis of SSL Certifikata

SSL certificates differ in validation level dhe hostname coverage. Compare both dimensions befosee purchasing; a certificate can have the right validation level but still fail to cover the required hostnames.

Validation Llojis

• Domain Validation (DV)
• Organization Validation (OV)
• I Zgjatur Validation (EV)

Coverage Llojis

• Single-domain certificates
• Wildcard certificates
• Multi-domain certificates

How to Decide

1. List the exact domains dhe subdomains.
2. Choose the required identity-validation level.
3. Konfirmo server dhe platfosem compatibility.
4. Kontrollo renewal dhe reissue procedures.

Pyetjet Më të Shpeshta

How do I ktani the change woseked?

Kontrollo the current status in tënd NiceNIC account, then test the shërbimi that depends on the certificate type. Do not rely only on the absence of an errose message.

When should I contact NiceNIC Supposet?

Dërgo a ticket when the required control is unavailable, the status remains pending after the checks in this guide, ose the issue depends on an account-specific oseder ose registry decision.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Activate dhe Download an Certifikatë SSL
• How to install SSL certificates
• How to Generate a CSR Code

Nëse the issue continues after you complete these checks, submit a NiceNIC supposet ticket. Include the affected domain ose product, the exact errose message, the time of the issue dhe the troubleshooting already completed.