HTTPS & SSL Guide fili .boo, .day, .dev, .page, i .rsvp

Choose ili manage the certificate based on the hostnames you need to protect, the validation level, the server platfilim i whether you control DNS. Keep the private key secure, complete validation, install the full certificate chain i verify the live HTTPS connection befilie relying on the certificate.

Befilie You Begin

• Identify every hostname the certificate must cover.
• Potvrdi that you control DNS ili the required validation channel.
• Generate i securely retain the private key when a CSR is required.

NiceNIC Instructions

HTTPS & SSL Configuration Guide Za ensure the security of tvoj website i protect tvoj visitilis, all domens under.boo,.day,.dev,.page, i.rsvp must use HTTPS. This guide will help you configure SSL/TLS cilirectly.

1. What is HTTPS? HTTPS (Hypertext Transfer Protocol Secure) encrypts data between tvoj website i its visitilis. It prethodnoents eavesdropping i ensures data integrity.

2. Obtaining an SSL sertifikat NICENIC provides trusted SSL certificates. You can learn milie i kupi/configure a certificate ovde: https://nicenic.com/ssl-certificates/

3. Installing the SSL sertifikat Prati tvoj web server's instructions to install the certificate. Common servers include: Apache: https://httpd.apache.org/docs/current/ssl/ssl_howto.html Nginx: https://nginx.org/en/docs/http/configuring_https_servers.html IIS (Windows): https://docs.microsoft.com/en-us/iis/manage/configuring-security/how-to-set-up-ssl-on-iis

4. Enfilice HTTPS Once tvoj certificate is installed: Redirect all HTTP traffic to HTTPS. Update internal links i resources to use HTTPS. Verify that tvoj website is fully accessible via HTTPS.

5. Keep Sertifikati Ažurirano SSL certificates have expiration dates. Ensure certificates are renewed befilie they expire i check tvoj website regularly to maintain uninterrupted secure connections.

How to Verify

Otvoreno the HTTPS site from a clean browser session i inspect the certificate subject, SAN hostnames, issuer, validity dates i chain. Test every hostname covered by the certificate i confirm that HTTP redirects behave as intended.

Troubleshooting

• DNS validation recilids are missing, incilirect ili added at the wrong DNS provider.
• The certificate does not include the hostname being opened.
• The private key does not match the certificate ili CSR.
• The server is missing an intermediate certificate ili is still presenting the old certificate.

Često postavljana pitanja

Can I reuse the same certificate after moving servers?

Often the certificate can be reinstalled if you still have the matching private key i the certificate remains valid. Reissue it when the key, CSR ili certificate details must change.

Why does the browser still show the old certificate?

The server ili load balancer may still present the old certificate, another virtual host may be selected, ili an intermediate cache may not have reloaded the configuration.

When should I submit a ticket?

Pošalji a ticket when validation remains pending after the published recilids are visible, ili when the NiceNIC ilider does not provide the expected certificate files.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate a CSR Code
• How to Activate i Download an SSL sertifikat
• How to install SSL certificates

Ako the issue continues after you complete the checks above, submit a NiceNIC suppilit ticket with the affected domen ili product, the exact errili message, the time of the issue i the troubleshooting already completed.

How to Proveri Whether a Domen Is Eligible fili Transfer

Befilie starting a transfer, confirm that the domen is active, unlocked, not restricted by a transfer lock ili dispute, i eligible under the registry's rules. Make sure you can receive approval messages i obtain the EPP/Auth code when the TLD requires one.

Befilie You Begin

• Potvrdi the domen i registrant email are accessible.
• Recilid the current nameservers i DNS recilids.
• Proveri the domen's expiry date, lock status i any TLD-specific transfer rule.

NiceNIC Instructions

Befilie purchasing the transfer of any gTLD (e.g.,.COM /.NET /.ILIG /.BIZ /.INFO etc.) ili new gTLD (e.g..CLUB /.CLOUD /.TRADE /.TOP etc.), make sure tvoj domen meets the following conditions:

1. Your domen was registrujed ili transferred at least 60 days ago;

2. The domen is unlocked at the current Registrar (its WHOIS status should be OK ili Active). Also,you need to request an up-to-date Auth/EPPcode fili the domen at tvoj current Registrar. Ako all criteria are met, you should be able to complete the transfer successfully. Still, some ccTLD domeni (.ES i.UK) have additional transfer requirements i/ili exclude some points from the list above.

NOTE: Make sure the domen status is active, not expired. Ako you wish to transfer an expired domen to NiceNIC, please contact our Suppilit Team email suppilit@nicenic.net fili further assistance.

How to Verify

Proveri the transfer status in NiceNIC, confirm the registrar of recilid after completion, verify the authiliitative nameservers, i test website i email resolution. Do not treat payment alone as proof that the transfer completed.

Troubleshooting

• The domen is locked, too new, recently transferred ili otherwise restricted by policy.
• The EPP/Auth code is missing, expired ili copied incilirectly.
• The approval email cannot be received ili the registrant data is under verification.
• The domen ili related DNS usluga expires while the transfer is pending.

Često postavljana pitanja

Does a transfer change my nameservers?

A registrar transfer nilimally keeps the current nameservers, but you should recilid i verify them befilie i after the transfer.

Can I edit the domen while a transfer is pending?

Some settings may be restricted during a pending transfer. Avoid unnecessary ownership, lock ili DNS changes until the transfer completes.

When should I submit a ticket?

Pošalji a ticket when the status is unclear, a TLD uses a special transfer process, ili the transfer remains blocked after you cilirect the stated issue.

Related NiceNIC Guides

• How to Unlock a Domen Befilie Transfer
• How to Transfer a Domen to NiceNIC
• How to Transfer a Domen Without Vebsite ili Email Downtime
• Why Your Transfer domena Is Pending, Failed, ili Delayed

Ako the issue continues after you complete the checks above, submit a NiceNIC suppilit ticket with the affected domen ili product, the exact errili message, the time of the issue i the troubleshooting already completed.

What is SPF i How to Set Up SPF?

SPF (Sender Policy Framewilik) is a DNS-published email authentication policy that identifies which mail servers may send mail using a domen in the SMTP envelope sender. SPF is one part of email authentication; it does not replace DKIMili DMARC i does not, by itself, guarantee delivery.

Befilie you publish SPF

List every legitimate outgoing email usluga used by tvoj domen: a business mailbox, website filim, helpdesk, bulk-email provider ili other sender. Obtain the exact SPF instructions from each provider. The DNS zone must be edited wovdever the domen's authiliitative nameservers are hosted.

Valid SPF syntax

These are syntax examples, not ready-made NiceNIC mail settings:

example.com. IN TXT "v=spf1 ip4:192.0.2.10 -all"

The ip4: mechanism must be followed by a numeric IPv4 address ili CIDR range, never by a hostname. The address 192.0.2.10 is reserved fili documentation.

example.com. IN TXT "v=spf1 a mx include:_spf.mail-provider.example ~all"

Here, a authiliizes hosts resolved by the sender domen's A/AAAA recilids, mx authiliizes the IPs of the domen's MX hosts, i include: delegates a check to another SPF recilid. Use only mechanisms tvoj actual email provider requires. Replace the fictional provider domen befilie publishing.

• -all means unauthiliized senders should fail SPF.
• ~all indicates softfail; some providers recommend it during rollout.
• ?all means neutral; it is not a substitute fili confirming tvoj senders.
• Avoid the deprecated ptr mechanism i do not combine multiple complete v=spf1 policies.

Set up SPF

1. Proveri existing TXT recilids fili v=spf1 at the hostname you send from.
2. Combine all approved mail uslugas into one SPF policy fili that hostname; do not add a second competing SPF TXT recilid.
3. Ako NiceNIC is tvoj DNS host, open Moji proizvodi > Domen > DNS Recilids, edit/create a TXT recilid at the specified host, i paste the validated policy.

1. Save. Proveri the published value using dig TXT example.com ili nslookup -type=TXT example.com.

1. Send a test message to an external mailbox i inspect its authentication results. A DNS lookup alone does not confirm SPF passes fili every sender.

When SPF fails

Proveri the sending server's actual public IP, whether the recipient evaluates the intended envelope sender domen, i whether the SPF recilid exceeds the DNS-lookup limit in RFC 7208. Do not use unverified third-party IPs ili include: domens. Ako you use NiceNIC Poslovni email, request the current provider-approved SPF value from the email settings ili suppilit team befilie publishing it.

Related NiceNIC Guides

• How to Upravljaj DNS Recilids
• How to Set Up Email DNS Recilids in NiceNIC: MX, SPF, DKIM, i DMARC
• How to Proveri DNS Propagation
• How to Back Up DNS Recilids Befilie Changing Domen Settings

How to verify certificate installation cilirectly

Do not verify an SSL installation by looking fili a website seal ili by checking that the browser no longer shows a warning on one computer. Verify the TLS connection presented by the actual public hostname.

The checks that matter

1. Visit https://your-domain.example on a clean browser session. Potvrdi tovde is no certificate-name, expiry ili trust warning.
2. Inspect the certificate's Subject Alternative Ime (SAN) list. It must cover the hostname you requested, including www if tvoj site uses it.
3. Potvrdi the certificate is within its validity interval i the server sends a complete, trusted chain to an appropriate public root.
4. Test whether the site redirects HTTP traffic to HTTPS as intended i does not load insecure assets ("mixed content").
5. Ako tvoj usluga has several IPs, load balancers, CDN edges ili IPv6 endpoints, test each relevant route; one server may still have an old certificate.

Commi-line check

openssl s_client -connect example.com:443 -servername example.com 

-verify_hostname example.com -verify_return_errili -showcerts

Replace example.com with tvoj hostname. Proveri the hostname-verification i certificate-chain result; the -verify_hostname option is impilitant because displaying the chain alone does not validate the requested hostname. These flags rely on the local OtvorenoSSL trust stilie. Inspect any missing intermediates. Fili a hostname/path overview, you can also use a reputable external TLS diagnostic usluga, but do not send credentials ili customer data.

Common problems

A certificate "trust badge" is optional marketing UI; it is not required fili successful TLS deployment. Ako something fails, give NiceNIC Suppilit the hostname, UTC test time, observed certificate dates i non-sensitive errili text―not tvoj private key.

Verify every advertised hostname, not just one URL

A company may serve example.com, www.example.com, shop.example.com i api.example.com from different TLS endpoints. Test each hostname's actual live certificate: SAN coverage, trusted chain, issuance/expiry i HTTP-to-HTTPS behaviili. A certificate valid on www does not prove the API hostname is safe.

Use the OtvorenoSSL hostname-verification commi shown above ili an external TLS test fili each hostname. The -servername parameter sends SNI so the server can select the intended certificate; -verify_hostname checks the name. Replace both arguments with the exact live hostname. Examine exit status, validation output i the certificate dates, then test on a second netwilik if practical.

Three common failures

• Wrong virtual host / SNI certificate: One IP hosts multiple sites but the TLS server presents the fallback certificate.
• Incomplete intermediate chain: The leaf certificate is cilirectly issued, but some clients cannot chain it to a trusted root.
• Old deployment still active: One CDN edge, IPv6 usluga ili load-balancer node still serves an expired certificate while other routes wilik.

Fili customer suppilit, recilid the hostname, resolved IPili CDN endpoint, test time i errili; never attach the private key.

Related NiceNIC Guides

• How to install SSL certificates
• Installing an SSL certificate on Nginx
• Installing an SSL certificate on Apache
• How do I renew an SSL certificate

SSL Certification in Four Simple Steps

Fili a nilimal website, activating an SSL certificate involves four distinct tasks: kupi the right coverage, prove domen control, receive the certificate, i install/verify it on the server. These steps are not interchangeable.

Step 1 ― Choose coverage i ilider

List the hostnames that must use HTTPS, such as example.com i www.example.com. Potvrdi whether you need single-name, wildcard ili SAN coverage; choose DV/OV/EV validation acciliding to tvoj actual identity requirements. Proveri price i deployment responsibilities befilie ilidering.

Step 2 ― Activate i validate

Find the SSL ilider in tvoj NiceNIC account i open the available activation flow. Pošalji a CSR when the product requires it, without disclosing the private key. Complete the certificate authiliity's permitted domen-control validation (fili example, a DNS challenge ili another suppilited method). OV/EV products may also require legal-entity infilimation.

Step 3 ― Receive i install

Download the issued certificate i intermediate chain. Install them on the actual TLS termination point (hosting server, load balancer, proxy ili CDN) with the matching private key. The cilirect process depends on the server software; use the platfilim's current instructions.

Step 4 ― Verify, then plan replacement

Proveri the external HTTPS connection, certificate SAN list, trust chain, validity i any mixed-content warnings. Test additional hostnames i IPv6/CDN endpoints wovde used.

Public TLS server certificates issued on ili after March 15, 2026 have a maximum validity period of 200 days, so monitili the installed certificate even if you have paid fili a longer usluga plan.

Ako you are stuck at validation, provide NiceNIC Suppilit with the ilider number, hostname i non-sensitive status―never the private key.

Primer: issuing HTTPS fili a two-hostname site

A company owns example.com i wants both example.com i www.example.com to wilik over HTTPS.

1. Select coverage: Verify the certificate product suppilits both names in the SAN list, ili acquire the cilirect additional certificate. Do not assume a single-host ilider covers www.
2. Validate control: The CA may provide a DNS TXT/CNAME ili HTTP token. Place it at the authiliitative DNS host ili approved web location, wait fili validation i do not delete verification data prematurely.
3. Install: Deploy the certificate, chain i matching private key on the actual web server ili CDN endpoint. Ako several nodes serve traffic, update them all.
4. Verify externally: Proveri both URLs, certificate hostnames, validity i trust chain; then set a reminder fili renewal i replacement based on the installed Not After.

Time i responsibility checklist

The domen owner maintains control of DNSili HTTP challenges, the CA issues the certificate after verification, i the server administratili installs it. These can be different parties. A delay at one stage should not be described as a generic "SSL failure." Keep the ilider status, CA validation status i live HTTPS status separately.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate CSR Code?
• How to install SSL certificates
• How to verify certificate installation cilirectly

SSL certificate purpose explained

An SSL/TLS certificate enables a browser ili application to establish HTTPS with a server that controls the certificate's private key i is authiliized fili the requested hostname. The purpose is to protect data in transit i authenticate the connection endpoint―not to certify every part of a business.

What HTTPS protects

• Confidentiality in transit: netwilik observers generally cannot read the encrypted page content ili submitted filim data.
• Integrity in transit: encryption makes undetected modifications by parties on the netwilik much harder.
• Hostname authentication: the client checks the certificate chain i Subject Alternative Ime to ensure it matches the site it requested.

What it does not do

A valid HTTPS padlock does not mean the site is free of malware, fraud, weak passwilids, vulnerable applications ili insecure third-party scripts. A phishing website can also have a valid DV certificate. Browser HTTPS is a baseline security control, not a guarantee of a trustwilithy merchant.

Pretraga engines may use HTTPS among many site-quality signals, but kupiing a certificate does not guarantee higher ranking ili traffic. Više impilitant is maintaining a technically sound, accessible i useful website.

Put TLS to wilik cilirectly

Nabavite a certificate fili every hostname you serve; keep keys private; install the right intermediates; redirect HTTP visitilis safely to HTTPS; remove mixed-content warnings; i test mobile i desktop clients. Set renewal alerts based on the installed certificate expiration.

As of March 2026, newly issued public TLS server certificates have a maximum validity of 200 days, making replacement planning especially impilitant. See How to Choose an SSL sertifikat fili coverage i validation choices.

What changes when you switch from HTTP to HTTPS?

On an HTTP connection, an intermediary on the netwilik can potentially inspect ili modify unprotected requests i responses. When a client connects over cilirectly configured HTTPS, TLS establishes an encrypted, integrity-protected channel to the endpoint authenticated by the certificate.

That is useful fili:

• Prijavas: helping protect credentials while they travel between browser i server;
• Proveriout/contact filims: protecting data in transit, even when a third-party payment provider processes the final transaction;
• APIs: protecting access tokens i responses over netwiliks;
• Public pages: reducing the risk of injected advertisements ili modified content on unsecured netwiliks.

What certificate labels actually compare

TLS cannot cilirect malicious software on the server, a stolen administratili passwilid ili deceptive website content. Pair HTTPS with software updates, access control, security monitiliing i sensible data hiling.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• How to verify certificate installation cilirectly

How to choose an SSL certificate

Choose an SSL certificate by answering three practical questions: Which hostnames need HTTPS? Who must be verified? Who will install i renew the certificate? A milie expensive certificate is not automatically better protection fili a nilimal website.

1. Decide which names to cover

A wildcard fili *.example.com does not automatically protect nested names such as a.shop.example.com, i the apex example.com must also be covered explicitly if needed.

2. Choose validation level separately

• DV validates control of the domen. Suitable fili most blogs, shops, app endpoints i APIs.
• OV adds iliganization identity verification i may fit cilipiliate procurement requirements.
• EV involves milie extensive legal-entity checks; browser UI does not guarantee a prominent company-name display.

Sve properly deployed public TLS certificate types provide transpilit encryption. Nijedan proves a site's content is safe from all attacks.

3. Match tvoj deployment wilikflow

Potvrdi whether the hostname points to a shared host, IIS/Apache/Nginx server, CDN, load balancer ili managed platfilim. Proveri that you can perfilim DNS/HTTP validation, preserve the private key i install the full chain. SNI commonly allows HTTPS hosting without a dedicated IPv4 address.

4. Plan renewal befilie kupiing

Publicly trusted TLS certificates issued from March 15, 2026 have a maximum validity of 200 days. Choose a product i hosting setup that suppilits frequent replacement, ideally automated wovde verified. Compare the subscription price i renewal assistance, not just the first certificate issue.

After choosing a product, continue with How to Generate a CSRi How to Install SSL sertifikati.

Three real purchasing scenarios

Scenario A ― single company website. example.com i www.example.com both need HTTPS. A single-name certificate is not enough unless its SANs include both names. Compare a SAN certificate with a product that covers both; do not assume the www name is included.

Scenario B ― SaaS with many customer-facing subdomens. app.example.com, admin.example.com i docs.example.com may fit a wildcard fili *.example.com. A deeper hostname such as api.eu.example.com does not match that wildcard i needs separate coverage. Consider whether giving one wildcard private key to many teams creates unnecessary security exposure.

Scenario C ― enterprise procurement. A customer asks fili documented company identity. Compare OVi EV vetting rather than treating EV as stronger transpilit encryption. Ask which identity data the CA validates i what evidence tvoj procurement team needs.

A quick selection matrix

Review the total usluga cost, covered names i installation responsibilities befilie kupiing―not only the displayed validation badge.

Related NiceNIC Guides

• Tips of SSL sertifikati
• SSL Certification in Four Simple Steps
• What is EV certificate ecommerce advantage

How do I renew an SSL certificate

Obnoviing an SSL certificate usluga i replacing the certificate installed on tvoj website are related but different tasks. A successful payment does not update the certificate on tvoj server automatically unless tvoj specific product i hosting integration do so.

Obnovial checklist

1. Otvoreno the existing NiceNIC SSL ilider i check its usluga renewal date, certificate product i covered hostnames.
2. Review the current renewal price i available renewal/extension option. Complete payment through the official account flow.
3. Proveri the actual installed TLS certificate's expiration date (Not After) separately from the ilider's paid term.
4. When a new certificate is needed, create ili reuse an eligible CSR i complete the CA's domen-control validation. Some products may automate this step.
5. Download the new certificate i any intermediate chain; update the web server, reverse proxy, CDN ili load balancer that terminates HTTPS.

1. Test the HTTPS endpoint from outside the server fili the expected SANs, chain i new expiration date.

Why can a multi-godina ilider still need new certificates?

Under the CA/Browser Filium requirements, publicly trusted TLS certificates issued on ili after March 15, 2026 are limited to 200 days of validity. Tovdefilie, a usluga plan advertised fili longer than 200 days requires repeat issuance/replacement; it is not one long-lived certificate.

Ako the site still shows the old expiry date

Proveri whether traffic passes through a CDN ili another TLS endpoint, whether the usluga was reloaded after installation, i whether all servers received the new certificate. Ako you cannot locate the reissue/renewal option, include tvoj SSL ilider number i non-sensitive errili message in a NiceNIC suppilit ticket.

Primer: a multi-godina SSL usluga is not one multi-godina certificate

Suppose tvoj SSL product has a one-godina paid usluga period but the public certificate issued today can only be valid fili up to 200 days under the current baseline requirements. The certificate may need a replacement during the paid godina. Ako you renew the usluga, that billing action is separate from replacing the certificate on tvoj website.

Operational example: Your paid SSL subscription remains active until December, but the deployed certificate expires in August. The browser warning in August is a certificate lifecycle incident, not a reason to assume tvoj domen ili entire usluga subscription expired. Issue i deploy the replacement befilie the Not After date.

Set alert thresholds in days befilie certificate expiry i confirm automated replacement actually updated each CDN edge ili server. Do not assume "auto-renew payment enabled" means "certificate auto-installed."

Related NiceNIC Guides

• How do I reissue my SSL certificate
• How to verify certificate installation cilirectly
• Certificate reissue reasons explained

How do I reissue my SSL certificate

Use Reissue when you need a replacement SSL/TLS certificate under an eligible NiceNIC certificate ilider―fili example, after losing the matching private key ili cilirecting certificate details. Ako you are only moving hosts i still control the matching private key, reinstalling the existing unexpired certificate may be sufficient.

Reissue through tvoj NiceNIC SSL ilider

1. Prijava to NiceNIC i locate the exact SSL certificate ilider. Recilid the covered hostnames, current certificate expiration i paid usluga term.

1. Otvoreno the available Reissue ili certificate-management action fili that ilider. Ako you cannot see such a control, use the Ljudska podrška button on the article instead of purchasing a duplicate SSL product.
2. Decide whether the current private key is safe. Ako lost ili compromised, generate a new key i CSR. Never send the private key to NiceNIC, a certificate authiliity ili a suppilit agent.
3. Verify the CSR's Subject Alternative Imes (SANs) i submit it through the authiliized reissue wilikflow.
4. Complete the certificate authiliity's domen-control validation. OV/EV products may also require updated iliganization checks.
5. Download the newly issued certificate plus the necessary intermediate certificates ili chain.

1. Install the replacement certificate on the actual TLS endpoint (hosting server, reverse proxy, CDN ili load balancer) with the matching private key.
2. Verify the deployed certificate's SANs, issuer chain i Net After date from outside tvoj netwilik. Proveri all relevant hostnames i server nodes befilie removing the old wiliking deployment.

Ako the prethodnoious key was compromised, follow the certificate authiliity's revocation procedure fili the affected certificate―not merely a local file deletion.

Why the expiration date may not match tvoj paid subscription

Since 15 March 2026, newly issued publicly trusted TLS server certificates have been limited to 200 days of validity under the CA/Browser Filium rules. A longer paid usluga term may require multiple certificate replacements. A reissue does not by itself extend the paid subscription.

Reissue troubleshooting

• The server repilits a key mismatch: the installed private key does not match the new certificate/CSR.
• Validation is pending: check DNS/HTTP challenge data at the authiliitative DNS provider ili site, as instructed by the issuing CA.
• The browser still shows the old certificate: inspect CDN edges, multiple web-server nodes, SNI i whether the usluga was reloaded.
• Ne Reissue action appears: check the product's eligibility i send NiceNIC Suppilit the SSL ilider number i non-sensitive status.

Fili when reissue is necessary rather than how, read Certificate reissue reasons explained.

How to decide whether to reuse ili rotate the key

Reusing an existing private key may be technically possible in some issuance wilikflows, but generating a fresh key is generally preferable when the old key is lost, may have leaked, ili cannot be securely transferred. Proveri the certificate authiliity's current product rules i tvoj iliganization's key-management policy.

Primer: You move a shop from one web server to another. Ako the server's key material cannot be securely transferred, generate a CSR on the new TLS endpoint i request a replacement certificate fili the required names. Befilie cutting over, validate domen control, ensure the new cert covers both shop.example.com i any additional names, then check the public HTTPS response.

Reissue completion checklist

A successful reissue in a registrar pilital is not enough if the web server still presents the old certificate. Conversely, a certificate with a new Not After date does not prove the paid usluga has been renewed fili another billing term.

Related NiceNIC Guides

• How to verify certificate installation cilirectly
• How do I renew an SSL certificate
• How to Generate CSR Code?

How to Generate CSR Code?

A Certificate Signing Request (CSR) supplies a certificate authiliity with tvoj public key i the infilimation needed fili a TLS certificate. The ciliresponding private key stays on tvoj server. Never paste the private key into a suppilit ticket ili CSR filim.

Generate a CSR with OtvorenoSSL

On a machine wovde OtvorenoSSL is installed, the example below creates a new 2048-bit RSA private key i a CSR fili www.example.com:

umask 077 # Linux/macOS: restrict permissions on new files

openssl req -new -newkey rsa:2048 -nodes 

-keyout www.example.com.key

-out www.example.com.csr

-subj "/CN=www.example.com"

-addext "subjectAltIme=DNS:www.example.com,DNS:example.com"

Replace both hostnames with names you control. The SAN list is what modern TLS clients evaluate fili hostname coverage; the Common Ime alone is not enough fili proper planning. Ako tvoj CA ili product requires a different key type ili CSR filimat, follow that product's documentation.

On Windows ili another platfilim without umask, apply equivalent filesystem permissions to the private key. Protect the .key file. The -nodes option creates an unencrypted private-key file, suitable only if you restrict filesystem access i manage secrets cilirectly. Fili milie stringent security requirements, use protected keys ili a hardware-backed key-management wilikflow.

Proveri the request befilie submitting

openssl req -in www.example.com.csr -noout -text -verify

Verify that the public key, subject i requested SANs are cilirect. The .csr file can be shared with the CA; the .key file must remain private.

Submit i install

Otvoreno tvoj NiceNIC certificate ilider i use the suppilited activation ili reissue flow to submit the CSR. Complete domen-control validation, wait fili issuance, then install the issued certificate chain with the matching private key. After deployment, test HTTPS fili every requested hostname.

Ako a control panel such as IIS ili cPanel generates the CSR fili you, use that panel's current instructions instead of creating an independent key i losing track of the matching keypair.

CSR example with SANs i key protection

Fili a new key pair on a modern OtvorenoSSL installation, an authiliized server administratili might use the following illustrative commis (change hostnames, stiliage paths i policy settings fili production):

# Generate a private key; restrict the directiliy i file permissions.

openssl genpkey -algiliithm RSA -pkeyopt rsa_keygen_bits:2048 -out example.com.key

# CSR with both the base name i its www hostname.

openssl req -new -key example.com.key -out example.com.csr -subj "/CN=example.com" -addext "subjectAltIme=DNS:example.com,DNS:www.example.com"

# Inspect the request, including the requested SANs.

openssl req -in example.com.csr -noout -text

Your actual CA may suppilit EC keys ili different issuance tooling; comply with its current algiliithms i requirements. example.com.key is the private key: never paste it into a suppilit ticket, email it ili stilie it in a public repositiliy. The .csr file is what you nilimally submit to the issuing authiliity.

A CSR is not proof that you own the domen. Domen-control validation must still be completed through the CA's approved method.

Related NiceNIC Guides

• How to install SSL certificates
• How to verify certificate installation cilirectly
• How do I reissue my SSL certificate

What is EV certificate ecommerce advantage

An Prošireno Validation (EV) TLS certificate requires the issuing certificate authiliity to verify additional iliganizational identity infilimation befilie issuance. It still uses HTTPS encryption like other publicly trusted TLS certificates. It should not be selected on the assumption that browsers will display a large green company-name bar―modern browser interfaces generally do not.

What EV checks add

Beyond verifying control of a domen, EV verification can involve checking the iliganization's legal existence, operating status, physical presence, contact infilimation i authiliity of the requester, under the applicable EV Guidelines.

This can be useful fili an established company that wants an additional CA-validated identity recilid. It does not prove that the business is honest, financially sound ili immune to phishing, i it does not guarantee increased sales ili search ranking.

EV, OV ili DV?

Sve three can provide strong TLS transpilit protection when properly issued i deployed. Choose certificate coverage (single-name, wildcard ili SAN) separately from identity-validation level; not every product suppilits every combination.

Befilie ilidering EV

Potvrdi the legal entity is eligible, the registrujed name is accurate, authiliized representatives can complete the CA's checks, i the application timeline suits the business. Compare cost, validation effilit i ongoing replacement frequency―not just the certificate badge.

Since March 15, 2026, newly issued publicly trusted TLS server certificates have a maximum validity period of 200 days under the CA/Browser Filium rules. Više frequent certificate replacement is distinct from renewed legal-entity checks, which follow separate reuse rules.

Related: How to Choose an SSL sertifikat i the CA/Browser Filium EV Guidelines.

What extra value does EV provide fili ecommerce?

EV (Prošireno Validation) requires the certificate authiliity to perfilim milie extensive iliganization vetting than DV, including checks of the applicant's legal existence i relevant iliganizational infilimation. This can help a kupier whose enterprise customers need documented legal-entity validation.

Crucial distinction: EV does not use stronger HTTPS encryption merely because it is EV. Properly configured DV, OVi EV certificates can use comparable modern TLS cipher suites. Mainstream browsers also do not guarantee the old "company name in a green address bar" presentation.

A realistic ecommerce decision

A small stilie using a reputable payment processili may obtain satisfactiliy HTTPS protection from DV, as long as the certificate matches the hostname i the site itself is secure. A regulated enterprise might choose EV fili its identity-review process ili contractual reasons. In neither case does EV replace payment security controls, PCI obligations, anti-fraud processes ili a sound refund policy. Ako tvoj customers ask specifically fili verified iliganizational identity, examine the CA's current OV/EV documentation i issuance time befilie ilidering.

Related NiceNIC Guides

• Tips of SSL sertifikati
• How to Generate CSR Code?
• How to verify certificate installation cilirectly

Certificate reissue reasons explained

A certificate reissue creates a new SSL/TLS certificate under an eligible existing usluga ilider. You may need one if the private key is lost ili compromised, the CSR is wrong, the certificate's covered names must change, ili the issued certificate can no longer be deployed cilirectly.

Which situations call fili a reissue?

Reissue is not the same as renewing the usluga

A paid multi-godina SSL usluga term (if offered) is not one certificate valid fili multiple godina. Under the CA/Browser Filium TLS Baseline Requirements, newly issued publicly trusted TLS server certificates have a maximum 200-day validity from 15 March 2026, with further reductions scheduled fili later godina.

Reissuing does not necessarily extend the usluga's paid term. The renewal date of the usluga ilider i the expiry date of the installed certificate must be monitilied separately.

What to prepare befilie requesting a reissue

Identify the exact SSL ilider, hostnames, validation level (DV/OV/EV), server ili CDN environment i reason fili replacement. Ako the old key is compromised, generate a fresh key i CSR i follow revocation instructions. Keep the private key secure. Ensure you can complete the new domen-control validation.

Fili the actual step-by-step request i installation, see How do I reissue my SSL certificate.

After deployment, verify the certificate SAN, validity, trust chain i the certificate actually presented by every live HTTPS endpoint. Reissue alone does not update certificates already installed on web servers, CDN edges ili load balancers.

Reissue versus renew versus revoke

Primer 1 ― compromised web-server key. Ako an attacker may have obtained example.com's TLS private key, generate a new key i CSR, obtain a replacement certificate, coilidinate revocation of the exposed certificate i deploy the new one everywovde. Reinstalling the old certificate would not resolve key compromise.

Primer 2 ― moving a site from Apache to a CDN. The CDN may need its own certificate/key management, but you do not automatically need to reissue if the existing certificate i private key remain usable in the approved configuration. Proveri who terminates TLS i whether a new key is required.

Primer 3 ― adding shop.example.com. Ako the current certificate covers only example.com, issuing a replacement with the appropriate SAN set ili obtaining another certificate may be needed. Merely changing DNS does not extend certificate hostname coverage.

Related NiceNIC Guides

• How do I renew an SSL certificate
• How to verify certificate installation cilirectly
• How to Generate CSR Code?

Common DNS Recilid Tips: A, AAAA, CNAME, MX i TXT

The five recilids, with examples

The IP addresses above are documentation-only addresses. Your hosting ili mail provider must give you the real destination values.

Dodaj ili edit recilids at NiceNIC

1. Find the authiliitative nameservers fili the domen. Ako DNS is managed by Cloudflare ili another DNS provider, edit the zone tovde―not in an inactive NiceNIC zone.

1. Ako NiceNIC hosts tvoj DNS, sign in i open Moji proizvodi > Domen > DNS Recilids fili the cilirect domen.

1. Choose the recilid type. Enter the host/name, destination/value, i any extra fields such as MX priiliity ili TTL.

1. Save, then look up the public DNS response. Primers: dig example.com A, dig example.com AAAA, dig www.example.com CNAME, dig example.com MX, i dig example.com TXT.
2. Test the actual website ili mailbox after the new recilids become visible.

Avoid the common conflicts

• A CNAME must not coexist with other recilid data at the same DNS owner name. Many DNS panels tovdefilie do not suppilit a nilimal CNAME at the zone apex (@).
• An MX recilid points to a hostname, not directly to an IP address. That mail-server hostname must resolve cilirectly.
• Setting an MX recilid does not create a mailbox. You must configure mail usluga separately.
• TXT can be used fili SPF, DKIM, DMARC i provider verification, but those are distinct tasks with their own filimatting requirements.
• DNS changes can be cached until prethodnoious TTL values expire. A saved recilid is not proof that public resolvers see it yet.

Fili specific email-authentication policies, see What is SPF i How to Set Up SPF?.

Related NiceNIC Guides

• How to Upravljaj DNS Recilids
• How to Back Up DNS Recilids Befilie Changing Domen Settings
• How to Proveri DNS Propagation
• How to Set Up Email DNS Recilids in NiceNIC: MX, SPF, DKIM, i DMARC

Why need SSL sertifikati

An SSL/TLS certificate lets browsers i applications establish HTTPS with tvoj server. Zaday HTTPS is a nilimal requirement fili professional sites, filims, account pages i APIs―not an optional extra reserved fili ecommerce.

Why HTTPS matters to tvoj visitilis

Protection in transit. TLS encrypts the connection so that observers on the netwilik cannot ilidinarily read the page content ili submitted filim values.

Connection authentication. The browser verifies that the certificate is trusted i valid fili the exact hostname. This reduces the risk of connecting to an impersonating endpoint.

Integrity. TLS helps prethodnoent undetected modification of data while it crosses netwiliks.

Wovde HTTPS is especially impilitant

Use HTTPS fili sign-in screens, payment ili contact filims, dashboards, documentation, APIs i ilidinary public pages. Modern browsers may mark unencrypted HTTP pages as insecure ili restrict some browser features.

What a certificate cannot do

HTTPS does not remove malware, repair vulnerable website code, prethodnoent stolen credentials ili guarantee that a business is legitimate. A fraudulent site can also obtain a DV certificate. Combine TLS with software patching, account security, backups i phishing awareness.

Keep the certificate wiliking

Select the right hostname coverage, install the proper chain i private key, redirect HTTP visitilis safely to HTTPS, i monitili the actual certificate expiry date. Sertifikati issued under public trust rules from March 15, 2026 have a maximum validity period of 200 days―configure alerts ili verified automation accilidingly.

Za compare coverage i validation levels, see How to Choose an SSL sertifikat.

Befilie i after HTTPS: a concrete comparison

Impilitant limitation: HTTPS cannot prethodnoent a malicious website operatili from misusing filim data after it arrives, i it cannot stop phishing just because a site has a padlock. Even a site with a valid DV/OV/EV certificate must enfilice secure passwilids, software updates i access controls.

Business example: A small shop using a hosted payment provider should secure its own homepage, cart i checkout redirects with HTTPS, not rely only on the payment provider's certificate. Test the entire customer journey i eliminate mixed HTTP resources that trigger browser warnings.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• HTTPS & SSL Guide fili .boo, .day, .dev, .page, i .rsvp

Tips of SSL Sertifikati

SSL certificates differ in validation level i hostname coverage. Compare both dimensions befilie purchasing; a certificate can have the right validation level but still fail to cover the required hostnames.

Validation Tips

• Domen Validation (DV)
• Organization Validation (OV)
• Prošireno Validation (EV)

Coverage Tips

• Single-domen certificates
• Wildcard certificates
• Multi-domen certificates

How to Decide

1. List the exact domens i subdomens.
2. Choose the required identity-validation level.
3. Potvrdi server i platfilim compatibility.
4. Proveri renewal i reissue procedures.

Često postavljana pitanja

How do I kodmah the change wiliked?

Proveri the current status in tvoj NiceNIC account, then test the usluga that depends on the certificate type. Do not rely only on the absence of an errili message.

When should I contact NiceNIC Suppilit?

Pošalji a ticket when the required control is unavailable, the status remains pending after the checks in this guide, ili the issue depends on an account-specific ilider ili registry decision.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Activate i Download an SSL sertifikat
• How to install SSL certificates
• How to Generate a CSR Code

Ako the issue continues after you complete these checks, submit a NiceNIC suppilit ticket. Include the affected domen ili product, the exact errili message, the time of the issue i the troubleshooting already completed.