HTTPS & SSL Guide fveya .boo, .day, .dev, .page, ve .rsvp

Choose veya manage the certificate based on the hostnames you need to protect, the validation level, the server platfveyam ve whether you control DNS. Keep the private key secure, complete validation, install the full certificate chain ve verify the live HTTPS connection befveyae relying on the certificate.

Befveyae You Begin

• Identify every hostname the certificate must cover.
• Onayla that you control DNS veya the required validation channel.
• Generate ve securely retain the private key when a CSR is required.

NiceNIC Instructions

HTTPS & SSL Configuration Guide İçin ensure the security of sizin website ve protect sizin visitveyas, all domains under.boo,.day,.dev,.page, ve.rsvp must use HTTPS. This guide will help you configure SSL/TLS cveyarectly.

1. What is HTTPS? HTTPS (Hypertext Transfer Protocol Secure) encrypts data between sizin website ve its visitveyas. It öncekients eavesdropping ve ensures data integrity.

2. Obtaining an SSL Sertifikası NICENIC provides trusted SSL certificates. You can learn mveyae ve satın al/configure a certificate buraya: https://nicenic.com/ssl-certificates/

3. Installing the SSL Sertifikası Takip Et sizin web server's instructions to install the certificate. Common servers include: Apache: https://httpd.apache.org/docs/current/ssl/ssl_howto.html Nginx: https://nginx.org/en/docs/http/configuring_https_servers.html IIS (Windows): https://docs.microsoft.com/en-us/iis/manage/configuring-security/how-to-set-up-ssl-on-iis

4. Enfveyace HTTPS Once sizin certificate is installed: Redirect all HTTP traffic to HTTPS. Update internal links ve resources to use HTTPS. Verify that sizin website is fully accessible via HTTPS.

5. Keep Sertifikalar Güncellendi SSL certificates have expiration dates. Ensure certificates are renewed befveyae they expire ve check sizin website regularly to maintain uninterrupted secure connections.

How to Verify

Aç the HTTPS site from a clean browser session ve inspect the certificate subject, SAN hostnames, issuer, validity dates ve chain. Test every hostname covered by the certificate ve confirm that HTTP redirects behave as intended.

Troubleshooting

• DNS validation recveyads are missing, incveyarect veya added at the wrong DNS provider.
• The certificate does not include the hostname being opened.
• The private key does not match the certificate veya CSR.
• The server is missing an intermediate certificate veya is still presenting the old certificate.

Sıkça Sorulan Sorular

Can I reuse the same certificate after moving servers?

Often the certificate can be reinstalled if you still have the matching private key ve the certificate remains valid. Reissue it when the key, CSR veya certificate details must change.

Why does the browser still show the old certificate?

The server veya load balancer may still present the old certificate, another virtual host may be selected, veya an intermediate cache may not have reloaded the configuration.

When should I submit a ticket?

Gönder a ticket when validation remains pending after the published recveyads are visible, veya when the NiceNIC veyader does not provide the expected certificate files.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate a CSR Code
• How to Activate ve Download an SSL Sertifikası
• How to install SSL certificates

Eğer the issue continues after you complete the checks above, submit a NiceNIC suppveyat ticket with the affected domain veya product, the exact errveya message, the time of the issue ve the troubleshooting already completed.

How to Kontrol Et Whether a Alan Adı Is Eligible fveya Transfer

Befveyae starting a transfer, confirm that the domain is active, unlocked, not restricted by a transfer lock veya dispute, ve eligible under the registry's rules. Make sure you can receive approval messages ve obtain the EPP/Auth code when the TLD requires one.

Befveyae You Begin

• Onayla the domain ve registrant email are accessible.
• Recveyad the current nameservers ve DNS recveyads.
• Kontrol Et the domain's expiry date, lock status ve any TLD-specific transfer rule.

NiceNIC Instructions

Befveyae purchasing the transfer of any gTLD (e.g.,.COM /.NET /.VEYAG /.BIZ /.INFO etc.) veya new gTLD (e.g..CLUB /.CLOUD /.TRADE /.TOP etc.), make sure sizin domain meets the following conditions:

1. Your domain was kayıt oled veya transferred at least 60 days ago;

2. The domain is unlocked at the current Kayıt Kuruluşu (its WHOIS status should be OK veya Active). Also,you need to request an up-to-date Auth/EPPcode fveya the domain at sizin current Kayıt Kuruluşu. Eğer all criteria are met, you should be able to complete the transfer successfully. Still, some ccTLD'ler (.ES ve.UK) have additional transfer requirements ve/veya exclude some points from the list above.

NOTE: Make sure the domain status is active, not expired. Eğer you wish to transfer an expired domain to NiceNIC, please contact our Suppveyat Team email suppveyat@nicenic.net fveya further assistance.

How to Verify

Kontrol Et the transfer status in NiceNIC, confirm the registrar of recveyad after completion, verify the authveyaitative nameservers, ve test website ve email resolution. Do not treat payment alone as proof that the transfer completed.

Troubleshooting

• The domain is locked, too new, recently transferred veya otherwise restricted by policy.
• The EPP/Auth code is missing, expired veya copied incveyarectly.
• The approval email cannot be received veya the registrant data is under verification.
• The domain veya related DNS hizmet expires while the transfer is pending.

Sıkça Sorulan Sorular

Does a transfer change my nameservers?

A registrar transfer nveyamally keeps the current nameservers, but you should recveyad ve verify them befveyae ve after the transfer.

Can I edit the domain while a transfer is pending?

Some settings may be restricted during a pending transfer. Avoid unnecessary ownership, lock veya DNS changes until the transfer completes.

When should I submit a ticket?

Gönder a ticket when the status is unclear, a TLD uses a special transfer process, veya the transfer remains blocked after you cveyarect the stated issue.

Related NiceNIC Guides

• How to Unlock a Alan Adı Befveyae Transfer
• How to Transfer a Alan Adı to NiceNIC
• How to Transfer a Alan Adı Without Website veya E-posta Downtime
• Why Your Domain Transferi Is Pending, Failed, veya Delayed

Eğer the issue continues after you complete the checks above, submit a NiceNIC suppveyat ticket with the affected domain veya product, the exact errveya message, the time of the issue ve the troubleshooting already completed.

What is SPF ve How to Set Up SPF?

SPF (Sender Policy Framewveyak) is a DNS-published email authentication policy that identifies which mail servers may send mail using a domain in the SMTP envelope sender. SPF is one part of email authentication; it does not replace DKIMveya DMARC ve does not, by itself, guarantee delivery.

Befveyae you publish SPF

List every legitimate outgoing email hizmet used by sizin domain: a business mailbox, website fveyam, helpdesk, bulk-email provider veya other sender. Obtain the exact SPF instructions from each provider. The DNS zone must be edited wburayaver the domain's authveyaitative nameservers are hosted.

Valid SPF syntax

These are syntax examples, not ready-made NiceNIC mail settings:

example.com. IN TXT "v=spf1 ip4:192.0.2.10 -all"

The ip4: mechanism must be followed by a numeric IPv4 address veya CIDR range, never by a hostname. The address 192.0.2.10 is reserved fveya documentation.

example.com. IN TXT "v=spf1 a mx include:_spf.mail-provider.example ~all"

Here, a authveyaizes hosts resolved by the sender domain's A/AAAA recveyads, mx authveyaizes the IPs of the domain's MX hosts, ve include: delegates a check to another SPF recveyad. Use only mechanisms sizin actual email provider requires. Replace the fictional provider domain befveyae publishing.

• -all means unauthveyaized senders should fail SPF.
• ~all indicates softfail; some providers recommend it during rollout.
• ?all means neutral; it is not a substitute fveya confirming sizin senders.
• Avoid the deprecated ptr mechanism ve do not combine multiple complete v=spf1 policies.

Set up SPF

1. Kontrol Et existing TXT recveyads fveya v=spf1 at the hostname you send from.
2. Combine all approved mail hizmets into one SPF policy fveya that hostname; do not add a second competing SPF TXT recveyad.
3. Eğer NiceNIC is sizin DNS host, open Ürünlerim > Alan Adı > DNS Recveyads, edit/create a TXT recveyad at the specified host, ve paste the validated policy.

1. Save. Kontrol Et the published value using dig TXT example.com veya nslookup -type=TXT example.com.

1. Send a test message to an external mailbox ve inspect its authentication results. A DNS lookup alone does not confirm SPF passes fveya every sender.

When SPF fails

Kontrol Et the sending server's actual public IP, whether the recipient evaluates the intended envelope sender domain, ve whether the SPF recveyad exceeds the DNS-lookup limit in RFC 7208. Do not use unverified third-party IPs veya include: domains. Eğer you use NiceNIC İş E-postası, request the current provider-approved SPF value from the email settings veya suppveyat team befveyae publishing it.

Related NiceNIC Guides

• How to Yönet DNS Recveyads
• How to Set Up E-posta DNS Recveyads in NiceNIC: MX, SPF, DKIM, ve DMARC
• How to Kontrol Et DNS Propagation
• How to Back Up DNS Recveyads Befveyae Changing Alan Adı Settings

How to verify certificate installation cveyarectly

Do not verify an SSL installation by looking fveya a website seal veya by checking that the browser no longer shows a warning on one computer. Verify the TLS connection presented by the actual public hostname.

The checks that matter

1. Visit https://your-domain.example on a clean browser session. Onayla tburaya is no certificate-name, expiry veya trust warning.
2. Inspect the certificate's Subject Alternative Ad (SAN) list. It must cover the hostname you requested, including www if sizin site uses it.
3. Onayla the certificate is within its validity interval ve the server sends a complete, trusted chain to an appropriate public root.
4. Test whether the site redirects HTTP traffic to HTTPS as intended ve does not load insecure assets ("mixed content").
5. Eğer sizin hizmet has several IPs, load balancers, CDN edges veya IPv6 endpoints, test each relevant route; one server may still have an old certificate.

Commve-line check

openssl s_client -connect example.com:443 -servername example.com 

-verify_hostname example.com -verify_return_errveya -showcerts

Replace example.com with sizin hostname. Kontrol Et the hostname-verification ve certificate-chain result; the -verify_hostname option is impveyatant because displaying the chain alone does not validate the requested hostname. These flags rely on the local AçSSL trust stveyae. Inspect any missing intermediates. Fveya a hostname/path overview, you can also use a reputable external TLS diagnostic hizmet, but do not send credentials veya customer data.

Common problems

A certificate "trust badge" is optional marketing UI; it is not required fveya successful TLS deployment. Eğer something fails, give NiceNIC Suppveyat the hostname, UTC test time, observed certificate dates ve non-sensitive errveya text―not sizin private key.

Verify every advertised hostname, not just one URL

A company may serve example.com, www.example.com, shop.example.com ve api.example.com from different TLS endpoints. Test each hostname's actual live certificate: SAN coverage, trusted chain, issuance/expiry ve HTTP-to-HTTPS behaviveya. A certificate valid on www does not prove the API hostname is safe.

Use the AçSSL hostname-verification commve shown above veya an external TLS test fveya each hostname. The -servername parameter sends SNI so the server can select the intended certificate; -verify_hostname checks the name. Replace both arguments with the exact live hostname. Examine exit status, validation output ve the certificate dates, then test on a second netwveyak if practical.

Three common failures

• Wrong virtual host / SNI certificate: One IP hosts multiple sites but the TLS server presents the fallback certificate.
• Incomplete intermediate chain: The leaf certificate is cveyarectly issued, but some clients cannot chain it to a trusted root.
• Old deployment still active: One CDN edge, IPv6 hizmet veya load-balancer node still serves an expired certificate while other routes wveyak.

Fveya customer suppveyat, recveyad the hostname, resolved IPveya CDN endpoint, test time ve errveya; never attach the private key.

Related NiceNIC Guides

• How to install SSL certificates
• Installing an SSL certificate on Nginx
• Installing an SSL certificate on Apache
• How do I renew an SSL certificate

SSL Certification in Four Simple Steps

Fveya a nveyamal website, activating an SSL certificate involves four distinct tasks: satın al the right coverage, prove domain control, receive the certificate, ve install/verify it on the server. These steps are not interchangeable.

Step 1 ― Choose coverage ve veyader

List the hostnames that must use HTTPS, such as example.com ve www.example.com. Onayla whether you need single-name, wildcard veya SAN coverage; choose DV/OV/EV validation accveyading to sizin actual identity requirements. Kontrol Et price ve deployment responsibilities befveyae veyadering.

Step 2 ― Activate ve validate

Find the SSL veyader in sizin NiceNIC account ve open the available activation flow. Gönder a CSR when the product requires it, without disclosing the private key. Complete the certificate authveyaity's permitted domain-control validation (fveya example, a DNS challenge veya another suppveyated method). OV/EV products may also require legal-entity infveyamation.

Step 3 ― Receive ve install

Download the issued certificate ve intermediate chain. Install them on the actual TLS termination point (hosting server, load balancer, proxy veya CDN) with the matching private key. The cveyarect process depends on the server software; use the platfveyam's current instructions.

Step 4 ― Verify, then plan replacement

Kontrol Et the external HTTPS connection, certificate SAN list, trust chain, validity ve any mixed-content warnings. Test additional hostnames ve IPv6/CDN endpoints wburaya used.

Public TLS server certificates issued on veya after March 15, 2026 have a maximum validity period of 200 days, so monitveya the installed certificate even if you have paid fveya a longer hizmet plan.

Eğer you are stuck at validation, provide NiceNIC Suppveyat with the veyader number, hostname ve non-sensitive status―never the private key.

Örnek: issuing HTTPS fveya a two-hostname site

A company owns example.com ve wants both example.com ve www.example.com to wveyak over HTTPS.

1. Select coverage: Verify the certificate product suppveyats both names in the SAN list, veya acquire the cveyarect additional certificate. Do not assume a single-host veyader covers www.
2. Validate control: The CA may provide a DNS TXT/CNAME veya HTTP token. Place it at the authveyaitative DNS host veya approved web location, wait fveya validation ve do not delete verification data prematurely.
3. Install: Deploy the certificate, chain ve matching private key on the actual web server veya CDN endpoint. Eğer several nodes serve traffic, update them all.
4. Verify externally: Kontrol Et both URLs, certificate hostnames, validity ve trust chain; then set a reminder fveya renewal ve replacement based on the installed Not After.

Time ve responsibility checklist

The domain owner maintains control of DNSveya HTTP challenges, the CA issues the certificate after verification, ve the server administratveya installs it. These can be different parties. A delay at one stage should not be described as a generic "SSL failure." Keep the veyader status, CA validation status ve live HTTPS status separately.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate CSR Code?
• How to install SSL certificates
• How to verify certificate installation cveyarectly

SSL certificate purpose explained

An SSL/TLS certificate enables a browser veya application to establish HTTPS with a server that controls the certificate's private key ve is authveyaized fveya the requested hostname. The purpose is to protect data in transit ve authenticate the connection endpoint―not to certify every part of a business.

What HTTPS protects

• Confidentiality in transit: netwveyak observers generally cannot read the encrypted page content veya submitted fveyam data.
• Integrity in transit: encryption makes undetected modifications by parties on the netwveyak much harder.
• Hostname authentication: the client checks the certificate chain ve Subject Alternative Ad to ensure it matches the site it requested.

What it does not do

A valid HTTPS padlock does not mean the site is free of malware, fraud, weak passwveyads, vulnerable applications veya insecure third-party scripts. A phishing website can also have a valid DV certificate. Browser HTTPS is a baseline security control, not a guarantee of a trustwveyathy merchant.

Ara engines may use HTTPS among many site-quality signals, but satın aling a certificate does not guarantee higher ranking veya traffic. Daha Fazla impveyatant is maintaining a technically sound, accessible ve useful website.

Put TLS to wveyak cveyarectly

Al a certificate fveya every hostname you serve; keep keys private; install the right intermediates; redirect HTTP visitveyas safely to HTTPS; remove mixed-content warnings; ve test mobile ve desktop clients. Set renewal alerts based on the installed certificate expiration.

As of March 2026, newly issued public TLS server certificates have a maximum validity of 200 days, making replacement planning especially impveyatant. See How to Choose an SSL Sertifikası fveya coverage ve validation choices.

What changes when you switch from HTTP to HTTPS?

On an HTTP connection, an intermediary on the netwveyak can potentially inspect veya modify unprotected requests ve responses. When a client connects over cveyarectly configured HTTPS, TLS establishes an encrypted, integrity-protected channel to the endpoint authenticated by the certificate.

That is useful fveya:

• Giriş Yaps: helping protect credentials while they travel between browser ve server;
• Kontrol Etout/contact fveyams: protecting data in transit, even when a third-party payment provider processes the final transaction;
• APIs: protecting access tokens ve responses over netwveyaks;
• Public pages: reducing the risk of injected advertisements veya modified content on unsecured netwveyaks.

What certificate labels actually compare

TLS cannot cveyarect malicious software on the server, a stolen administratveya passwveyad veya deceptive website content. Pair HTTPS with software updates, access control, security monitveyaing ve sensible data hveling.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• How to verify certificate installation cveyarectly

How to choose an SSL certificate

Choose an SSL certificate by answering three practical questions: Which hostnames need HTTPS? Who must be verified? Who will install ve renew the certificate? A mveyae expensive certificate is not automatically better protection fveya a nveyamal website.

1. Decide which names to cover

A wildcard fveya *.example.com does not automatically protect nested names such as a.shop.example.com, ve the apex example.com must also be covered explicitly if needed.

2. Choose validation level separately

• DV validates control of the domain. Suitable fveya most blogs, shops, app endpoints ve APIs.
• OV adds veyaganization identity verification ve may fit cveyapveyaate procurement requirements.
• EV involves mveyae extensive legal-entity checks; browser UI does not guarantee a prominent company-name display.

Tümü properly deployed public TLS certificate types provide transpveyat encryption. Yok proves a site's content is safe from all attacks.

3. Match sizin deployment wveyakflow

Onayla whether the hostname points to a shared host, IIS/Apache/Nginx server, CDN, load balancer veya managed platfveyam. Kontrol Et that you can perfveyam DNS/HTTP validation, preserve the private key ve install the full chain. SNI commonly allows HTTPS hosting without a dedicated IPv4 address.

4. Plan renewal befveyae satın aling

Publicly trusted TLS certificates issued from March 15, 2026 have a maximum validity of 200 days. Choose a product ve hosting setup that suppveyats frequent replacement, ideally automated wburaya verified. Compare the subscription price ve renewal assistance, not just the first certificate issue.

After choosing a product, continue with How to Generate a CSRve How to Install SSL Sertifikaları.

Three real purchasing scenarios

Scenario A ― single company website. example.com ve www.example.com both need HTTPS. A single-name certificate is not enough unless its SANs include both names. Compare a SAN certificate with a product that covers both; do not assume the www name is included.

Scenario B ― SaaS with many customer-facing subdomains. app.example.com, admin.example.com ve docs.example.com may fit a wildcard fveya *.example.com. A deeper hostname such as api.eu.example.com does not match that wildcard ve needs separate coverage. Consider whether giving one wildcard private key to many teams creates unnecessary security exposure.

Scenario C ― enterprise procurement. A customer asks fveya documented company identity. Compare OVve EV vetting rather than treating EV as stronger transpveyat encryption. Ask which identity data the CA validates ve what evidence sizin procurement team needs.

A quick selection matrix

Review the total hizmet cost, covered names ve installation responsibilities befveyae satın aling―not only the displayed validation badge.

Related NiceNIC Guides

• Türs of SSL Sertifikaları
• SSL Certification in Four Simple Steps
• What is EV certificate ecommerce advantage

How do I renew an SSL certificate

Yenileing an SSL certificate hizmet ve replacing the certificate installed on sizin website are related but different tasks. A successful payment does not update the certificate on sizin server automatically unless sizin specific product ve hosting integration do so.

Yenileal checklist

1. Aç the existing NiceNIC SSL veyader ve check its hizmet renewal date, certificate product ve covered hostnames.
2. Review the current renewal price ve available renewal/extension option. Complete payment through the official account flow.
3. Kontrol Et the actual installed TLS certificate's expiration date (Not After) separately from the veyader's paid term.
4. When a new certificate is needed, create veya reuse an eligible CSR ve complete the CA's domain-control validation. Some products may automate this step.
5. Download the new certificate ve any intermediate chain; update the web server, reverse proxy, CDN veya load balancer that terminates HTTPS.

1. Test the HTTPS endpoint from outside the server fveya the expected SANs, chain ve new expiration date.

Why can a multi-yıl veyader still need new certificates?

Under the CA/Browser Fveyaum requirements, publicly trusted TLS certificates issued on veya after March 15, 2026 are limited to 200 days of validity. Tburayafveyae, a hizmet plan advertised fveya longer than 200 days requires repeat issuance/replacement; it is not one long-lived certificate.

Eğer the site still shows the old expiry date

Kontrol Et whether traffic passes through a CDN veya another TLS endpoint, whether the hizmet was reloaded after installation, ve whether all servers received the new certificate. Eğer you cannot locate the reissue/renewal option, include sizin SSL veyader number ve non-sensitive errveya message in a NiceNIC suppveyat ticket.

Örnek: a multi-yıl SSL hizmet is not one multi-yıl certificate

Suppose sizin SSL product has a one-yıl paid hizmet period but the public certificate issued today can only be valid fveya up to 200 days under the current baseline requirements. The certificate may need a replacement during the paid yıl. Eğer you renew the hizmet, that billing action is separate from replacing the certificate on sizin website.

Operational example: Your paid SSL subscription remains active until December, but the deployed certificate expires in August. The browser warning in August is a certificate lifecycle incident, not a reason to assume sizin domain veya entire hizmet subscription expired. Issue ve deploy the replacement befveyae the Not After date.

Set alert thresholds in days befveyae certificate expiry ve confirm automated replacement actually updated each CDN edge veya server. Do not assume "auto-renew payment enabled" means "certificate auto-installed."

Related NiceNIC Guides

• How do I reissue my SSL certificate
• How to verify certificate installation cveyarectly
• Certificate reissue reasons explained

How do I reissue my SSL certificate

Use Reissue when you need a replacement SSL/TLS certificate under an eligible NiceNIC certificate veyader―fveya example, after losing the matching private key veya cveyarecting certificate details. Eğer you are only moving hosts ve still control the matching private key, reinstalling the existing unexpired certificate may be sufficient.

Reissue through sizin NiceNIC SSL veyader

1. Giriş Yap to NiceNIC ve locate the exact SSL certificate veyader. Recveyad the covered hostnames, current certificate expiration ve paid hizmet term.

1. Aç the available Reissue veya certificate-management action fveya that veyader. Eğer you cannot see such a control, use the İnsan Desteği button on the article instead of purchasing a duplicate SSL product.
2. Decide whether the current private key is safe. Eğer lost veya compromised, generate a new key ve CSR. Never send the private key to NiceNIC, a certificate authveyaity veya a suppveyat agent.
3. Verify the CSR's Subject Alternative Ads (SANs) ve submit it through the authveyaized reissue wveyakflow.
4. Complete the certificate authveyaity's domain-control validation. OV/EV products may also require updated veyaganization checks.
5. Download the newly issued certificate plus the necessary intermediate certificates veya chain.

1. Install the replacement certificate on the actual TLS endpoint (hosting server, reverse proxy, CDN veya load balancer) with the matching private key.
2. Verify the deployed certificate's SANs, issuer chain ve Hayırt After date from outside sizin netwveyak. Kontrol Et all relevant hostnames ve server nodes befveyae removing the old wveyaking deployment.

Eğer the öncekiious key was compromised, follow the certificate authveyaity's revocation procedure fveya the affected certificate―not merely a local file deletion.

Why the expiration date may not match sizin paid subscription

Since 15 March 2026, newly issued publicly trusted TLS server certificates have been limited to 200 days of validity under the CA/Browser Fveyaum rules. A longer paid hizmet term may require multiple certificate replacements. A reissue does not by itself extend the paid subscription.

Reissue troubleshooting

• The server repveyats a key mismatch: the installed private key does not match the new certificate/CSR.
• Validation is pending: check DNS/HTTP challenge data at the authveyaitative DNS provider veya site, as instructed by the issuing CA.
• The browser still shows the old certificate: inspect CDN edges, multiple web-server nodes, SNI ve whether the hizmet was reloaded.
• Hayır Reissue action appears: check the product's eligibility ve send NiceNIC Suppveyat the SSL veyader number ve non-sensitive status.

Fveya when reissue is necessary rather than how, read Certificate reissue reasons explained.

How to decide whether to reuse veya rotate the key

Reusing an existing private key may be technically possible in some issuance wveyakflows, but generating a fresh key is generally preferable when the old key is lost, may have leaked, veya cannot be securely transferred. Kontrol Et the certificate authveyaity's current product rules ve sizin veyaganization's key-management policy.

Örnek: You move a shop from one web server to another. Eğer the server's key material cannot be securely transferred, generate a CSR on the new TLS endpoint ve request a replacement certificate fveya the required names. Befveyae cutting over, validate domain control, ensure the new cert covers both shop.example.com ve any additional names, then check the public HTTPS response.

Reissue completion checklist

A successful reissue in a registrar pveyatal is not enough if the web server still presents the old certificate. Conversely, a certificate with a new Not After date does not prove the paid hizmet has been renewed fveya another billing term.

Related NiceNIC Guides

• How to verify certificate installation cveyarectly
• How do I renew an SSL certificate
• How to Generate CSR Code?

How to Generate CSR Code?

A Certificate Signing Request (CSR) supplies a certificate authveyaity with sizin public key ve the infveyamation needed fveya a TLS certificate. The cveyaresponding private key stays on sizin server. Never paste the private key into a suppveyat ticket veya CSR fveyam.

Generate a CSR with AçSSL

On a machine wburaya AçSSL is installed, the example below creates a new 2048-bit RSA private key ve a CSR fveya www.example.com:

umask 077 # Linux/macİşletim Sistemi: restrict permissions on new files

openssl req -new -newkey rsa:2048 -nodes 

-keyout www.example.com.key

-out www.example.com.csr

-subj "/CN=www.example.com"

-addext "subjectAltAd=DNS:www.example.com,DNS:example.com"

Replace both hostnames with names you control. The SAN list is what modern TLS clients evaluate fveya hostname coverage; the Common Ad alone is not enough fveya proper planning. Eğer sizin CA veya product requires a different key type veya CSR fveyamat, follow that product's documentation.

On Windows veya another platfveyam without umask, apply equivalent filesystem permissions to the private key. Protect the .key file. The -nodes option creates an unencrypted private-key file, suitable only if you restrict filesystem access ve manage secrets cveyarectly. Fveya mveyae stringent security requirements, use protected keys veya a hardware-backed key-management wveyakflow.

Kontrol Et the request befveyae submitting

openssl req -in www.example.com.csr -noout -text -verify

Verify that the public key, subject ve requested SANs are cveyarect. The .csr file can be shared with the CA; the .key file must remain private.

Submit ve install

Aç sizin NiceNIC certificate veyader ve use the suppveyated activation veya reissue flow to submit the CSR. Complete domain-control validation, wait fveya issuance, then install the issued certificate chain with the matching private key. After deployment, test HTTPS fveya every requested hostname.

Eğer a control panel such as IIS veya cPanel generates the CSR fveya you, use that panel's current instructions instead of creating an independent key ve losing track of the matching keypair.

CSR example with SANs ve key protection

Fveya a new key pair on a modern AçSSL installation, an authveyaized server administratveya might use the following illustrative commves (change hostnames, stveyaage paths ve policy settings fveya production):

# Generate a private key; restrict the directveyay ve file permissions.

openssl genpkey -algveyaithm RSA -pkeyopt rsa_keygen_bits:2048 -out example.com.key

# CSR with both the base name ve its www hostname.

openssl req -new -key example.com.key -out example.com.csr -subj "/CN=example.com" -addext "subjectAltAd=DNS:example.com,DNS:www.example.com"

# Inspect the request, including the requested SANs.

openssl req -in example.com.csr -noout -text

Your actual CA may suppveyat EC keys veya different issuance tooling; comply with its current algveyaithms ve requirements. example.com.key is the private key: never paste it into a suppveyat ticket, email it veya stveyae it in a public repositveyay. The .csr file is what you nveyamally submit to the issuing authveyaity.

A CSR is not proof that you own the domain. Alan Adı-control validation must still be completed through the CA's approved method.

Related NiceNIC Guides

• How to install SSL certificates
• How to verify certificate installation cveyarectly
• How do I reissue my SSL certificate

What is EV certificate ecommerce advantage

An Genişletilmiş Validation (EV) TLS certificate requires the issuing certificate authveyaity to verify additional veyaganizational identity infveyamation befveyae issuance. It still uses HTTPS encryption like other publicly trusted TLS certificates. It should not be selected on the assumption that browsers will display a large green company-name bar―modern browser interfaces generally do not.

What EV checks add

Beyond verifying control of a domain, EV verification can involve checking the veyaganization's legal existence, operating status, physical presence, contact infveyamation ve authveyaity of the requester, under the applicable EV Guidelines.

This can be useful fveya an established company that wants an additional CA-validated identity recveyad. It does not prove that the business is honest, financially sound veya immune to phishing, ve it does not guarantee increased sales veya search ranking.

EV, OV veya DV?

Tümü three can provide strong TLS transpveyat protection when properly issued ve deployed. Choose certificate coverage (single-name, wildcard veya SAN) separately from identity-validation level; not every product suppveyats every combination.

Befveyae veyadering EV

Onayla the legal entity is eligible, the kayıt oled name is accurate, authveyaized representatives can complete the CA's checks, ve the application timeline suits the business. Compare cost, validation effveyat ve ongoing replacement frequency―not just the certificate badge.

Since March 15, 2026, newly issued publicly trusted TLS server certificates have a maximum validity period of 200 days under the CA/Browser Fveyaum rules. Daha Fazla frequent certificate replacement is distinct from renewed legal-entity checks, which follow separate reuse rules.

Related: How to Choose an SSL Sertifikası ve the CA/Browser Fveyaum EV Guidelines.

What extra value does EV provide fveya ecommerce?

EV (Genişletilmiş Validation) requires the certificate authveyaity to perfveyam mveyae extensive veyaganization vetting than DV, including checks of the applicant's legal existence ve relevant veyaganizational infveyamation. This can help a satın aler whose enterprise customers need documented legal-entity validation.

Crucial distinction: EV does not use stronger HTTPS encryption merely because it is EV. Properly configured DV, OVve EV certificates can use comparable modern TLS cipher suites. Mainstream browsers also do not guarantee the old "company name in a green address bar" presentation.

A realistic ecommerce decision

A small stveyae using a reputable payment processveya may obtain satisfactveyay HTTPS protection from DV, as long as the certificate matches the hostname ve the site itself is secure. A regulated enterprise might choose EV fveya its identity-review process veya contractual reasons. In neither case does EV replace payment security controls, PCI obligations, anti-fraud processes veya a sound refund policy. Eğer sizin customers ask specifically fveya verified veyaganizational identity, examine the CA's current OV/EV documentation ve issuance time befveyae veyadering.

Related NiceNIC Guides

• Türs of SSL Sertifikaları
• How to Generate CSR Code?
• How to verify certificate installation cveyarectly

Certificate reissue reasons explained

A certificate reissue creates a new SSL/TLS certificate under an eligible existing hizmet veyader. You may need one if the private key is lost veya compromised, the CSR is wrong, the certificate's covered names must change, veya the issued certificate can no longer be deployed cveyarectly.

Which situations call fveya a reissue?

Reissue is not the same as renewing the hizmet

A paid multi-yıl SSL hizmet term (if offered) is not one certificate valid fveya multiple yıl. Under the CA/Browser Fveyaum TLS Baseline Requirements, newly issued publicly trusted TLS server certificates have a maximum 200-day validity from 15 March 2026, with further reductions scheduled fveya later yıl.

Reissuing does not necessarily extend the hizmet's paid term. The renewal date of the hizmet veyader ve the expiry date of the installed certificate must be monitveyaed separately.

What to prepare befveyae requesting a reissue

Identify the exact SSL veyader, hostnames, validation level (DV/OV/EV), server veya CDN environment ve reason fveya replacement. Eğer the old key is compromised, generate a fresh key ve CSR ve follow revocation instructions. Keep the private key secure. Ensure you can complete the new domain-control validation.

Fveya the actual step-by-step request ve installation, see How do I reissue my SSL certificate.

After deployment, verify the certificate SAN, validity, trust chain ve the certificate actually presented by every live HTTPS endpoint. Reissue alone does not update certificates already installed on web servers, CDN edges veya load balancers.

Reissue versus renew versus revoke

Örnek 1 ― compromised web-server key. Eğer an attacker may have obtained example.com's TLS private key, generate a new key ve CSR, obtain a replacement certificate, coveyadinate revocation of the exposed certificate ve deploy the new one everywburaya. Reinstalling the old certificate would not resolve key compromise.

Örnek 2 ― moving a site from Apache to a CDN. The CDN may need its own certificate/key management, but you do not automatically need to reissue if the existing certificate ve private key remain usable in the approved configuration. Kontrol Et who terminates TLS ve whether a new key is required.

Örnek 3 ― adding shop.example.com. Eğer the current certificate covers only example.com, issuing a replacement with the appropriate SAN set veya obtaining another certificate may be needed. Merely changing DNS does not extend certificate hostname coverage.

Related NiceNIC Guides

• How do I renew an SSL certificate
• How to verify certificate installation cveyarectly
• How to Generate CSR Code?

Common DNS Recveyad Türs: A, AAAA, CNAME, MX ve TXT

The five recveyads, with examples

The IP addresses above are documentation-only addresses. Your hosting veya mail provider must give you the real destination values.

Ekle veya edit recveyads at NiceNIC

1. Find the authveyaitative nameservers fveya the domain. Eğer DNS is managed by Cloudflare veya another DNS provider, edit the zone tburaya―not in an inactive NiceNIC zone.

1. Eğer NiceNIC hosts sizin DNS, sign in ve open Ürünlerim > Alan Adı > DNS Recveyads fveya the cveyarect domain.

1. Choose the recveyad type. Enter the host/name, destination/value, ve any extra fields such as MX priveyaity veya TTL.

1. Save, then look up the public DNS response. Örneks: dig example.com A, dig example.com AAAA, dig www.example.com CNAME, dig example.com MX, ve dig example.com TXT.
2. Test the actual website veya mailbox after the new recveyads become visible.

Avoid the common conflicts

• A CNAME must not coexist with other recveyad data at the same DNS owner name. Many DNS panels tburayafveyae do not suppveyat a nveyamal CNAME at the zone apex (@).
• An MX recveyad points to a hostname, not directly to an IP address. That mail-server hostname must resolve cveyarectly.
• Setting an MX recveyad does not create a mailbox. You must configure mail hizmet separately.
• TXT can be used fveya SPF, DKIM, DMARC ve provider verification, but those are distinct tasks with their own fveyamatting requirements.
• DNS changes can be cached until öncekiious TTL values expire. A saved recveyad is not proof that public resolvers see it yet.

Fveya specific email-authentication policies, see What is SPF ve How to Set Up SPF?.

Related NiceNIC Guides

• How to Yönet DNS Recveyads
• How to Back Up DNS Recveyads Befveyae Changing Alan Adı Settings
• How to Kontrol Et DNS Propagation
• How to Set Up E-posta DNS Recveyads in NiceNIC: MX, SPF, DKIM, ve DMARC

Why need SSL Sertifikaları

An SSL/TLS certificate lets browsers ve applications establish HTTPS with sizin server. İçinday HTTPS is a nveyamal requirement fveya professional sites, fveyams, account pages ve APIs―not an optional extra reserved fveya ecommerce.

Why HTTPS matters to sizin visitveyas

Protection in transit. TLS encrypts the connection so that observers on the netwveyak cannot veyadinarily read the page content veya submitted fveyam values.

Connection authentication. The browser verifies that the certificate is trusted ve valid fveya the exact hostname. This reduces the risk of connecting to an impersonating endpoint.

Integrity. TLS helps öncekient undetected modification of data while it crosses netwveyaks.

Wburaya HTTPS is especially impveyatant

Use HTTPS fveya sign-in screens, payment veya contact fveyams, dashboards, documentation, APIs ve veyadinary public pages. Modern browsers may mark unencrypted HTTP pages as insecure veya restrict some browser features.

What a certificate cannot do

HTTPS does not remove malware, repair vulnerable website code, öncekient stolen credentials veya guarantee that a business is legitimate. A fraudulent site can also obtain a DV certificate. Combine TLS with software patching, account security, backups ve phishing awareness.

Keep the certificate wveyaking

Select the right hostname coverage, install the proper chain ve private key, redirect HTTP visitveyas safely to HTTPS, ve monitveya the actual certificate expiry date. Sertifikalar issued under public trust rules from March 15, 2026 have a maximum validity period of 200 days―configure alerts veya verified automation accveyadingly.

İçin compare coverage ve validation levels, see How to Choose an SSL Sertifikası.

Befveyae ve after HTTPS: a concrete comparison

Impveyatant limitation: HTTPS cannot öncekient a malicious website operatveya from misusing fveyam data after it arrives, ve it cannot stop phishing just because a site has a padlock. Even a site with a valid DV/OV/EV certificate must enfveyace secure passwveyads, software updates ve access controls.

Business example: A small shop using a hosted payment provider should secure its own homepage, cart ve checkout redirects with HTTPS, not rely only on the payment provider's certificate. Test the entire customer journey ve eliminate mixed HTTP resources that trigger browser warnings.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• HTTPS & SSL Guide fveya .boo, .day, .dev, .page, ve .rsvp

Türs of SSL Sertifikalar

SSL certificates differ in validation level ve hostname coverage. Compare both dimensions befveyae purchasing; a certificate can have the right validation level but still fail to cover the required hostnames.

Validation Türs

• Alan Adı Validation (DV)
• Organization Validation (OV)
• Genişletilmiş Validation (EV)

Coverage Türs

• Single-domain certificates
• Wildcard certificates
• Multi-domain certificates

How to Decide

1. List the exact domains ve subdomains.
2. Choose the required identity-validation level.
3. Onayla server ve platfveyam compatibility.
4. Kontrol Et renewal ve reissue procedures.

Sıkça Sorulan Sorular

How do I kşimdi the change wveyaked?

Kontrol Et the current status in sizin NiceNIC account, then test the hizmet that depends on the certificate type. Do not rely only on the absence of an errveya message.

When should I contact NiceNIC Suppveyat?

Gönder a ticket when the required control is unavailable, the status remains pending after the checks in this guide, veya the issue depends on an account-specific veyader veya registry decision.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Activate ve Download an SSL Sertifikası
• How to install SSL certificates
• How to Generate a CSR Code

Eğer the issue continues after you complete these checks, submit a NiceNIC suppveyat ticket. Include the affected domain veya product, the exact errveya message, the time of the issue ve the troubleshooting already completed.