HTTPS & SSL Guide fабо .boo, .day, .dev, .page, і .rsvp

Choose або manage the certificate based on the hostnames you need to protect, the validation level, the server platfабоm і whether you control DNS. Keep the private key secure, complete validation, install the full certificate chain і verify the live HTTPS connection befабоe relying on the certificate.

Befабоe You Begin

• Identify every hostname the certificate must cover.
• Підтвердити that you control DNS або the required validation channel.
• Generate і securely retain the private key when a CSR is required.

NiceNIC Instructions

HTTPS & SSL Configuration Guide До ensure the security of ваш website і protect ваш visitабоs, all доменs under.boo,.day,.dev,.page, і.rsvp must use HTTPS. This guide will help you configure SSL/TLS cабоrectly.

1. What is HTTPS? HTTPS (Hypertext Transfer Protocol Secure) encrypts data between ваш website і its visitабоs. It назадents eavesdropping і ensures data integrity.

2. Obtaining an SSL-сертифікат NICENIC provides trusted SSL certificates. You can learn mабоe і придбати/configure a certificate тут: https://nicenic.com/ssl-certificates/

3. Installing the SSL-сертифікат Слідкувати ваш web server's instructions to install the certificate. Common servers include: Apache: https://httpd.apache.org/docs/current/ssl/ssl_howto.html Nginx: https://nginx.org/en/docs/http/configuring_https_servers.html IIS (Windows): https://docs.microsoft.com/en-us/iis/manage/configuring-security/how-to-set-up-ssl-on-iis

4. Enfабоce HTTPS Once ваш certificate is installed: Redirect all HTTP traffic to HTTPS. Update internal links і resources to use HTTPS. Verify that ваш website is fully accessible via HTTPS.

5. Keep Сертифікати Оновлено SSL certificates have expiration dates. Ensure certificates are renewed befабоe they expire і check ваш website regularly to maintain uninterrupted secure connections.

How to Verify

Відкрити the HTTPS site from a clean browser session і inspect the certificate subject, SAN hostnames, issuer, validity dates і chain. Test every hostname covered by the certificate і confirm that HTTP redirects behave as intended.

Troubleshooting

• DNS validation recабоds are missing, incабоrect або added at the wrong DNS provider.
• The certificate does not include the hostname being opened.
• The private key does not match the certificate або CSR.
• The server is missing an intermediate certificate або is still presenting the old certificate.

Поширені запитання

Can I reuse the same certificate after moving servers?

Often the certificate can be reinstalled if you still have the matching private key і the certificate remains valid. Reissue it when the key, CSR або certificate details must change.

Why does the browser still show the old certificate?

The server або load balancer may still present the old certificate, another virtual host may be selected, або an intermediate cache may not have reloaded the configuration.

When should I submit a ticket?

Надіслати a ticket when validation remains pending after the published recабоds are visible, або when the NiceNIC абоder does not provide the expected certificate files.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate a CSR Code
• How to Activate і Download an SSL-сертифікат
• How to install SSL certificates

Якщо the issue continues after you complete the checks above, submit a NiceNIC suppабоt ticket with the affected домен або product, the exact errабо message, the time of the issue і the troubleshooting already completed.

How to Перевірити Whether a Домен Is Eligible fабо Transfer

Befабоe starting a transfer, confirm that the домен is active, unlocked, not restricted by a transfer lock або dispute, і eligible under the registry's rules. Make sure you can receive approval messages і obtain the EPP/Auth code when the TLD requires one.

Befабоe You Begin

• Підтвердити the домен і registrant email are accessible.
• Recабоd the current nameservers і DNS recабоds.
• Перевірити the домен's expiry date, lock status і any TLD-specific transfer rule.

NiceNIC Instructions

Befабоe purchasing the transfer of any gTLD (e.g.,.COM /.NET /.АБОG /.BIZ /.INFO etc.) або new gTLD (e.g..CLUB /.CLOUD /.TRADE /.TOP etc.), make sure ваш домен meets the following conditions:

1. Your домен was зареєструватиed або transferred at least 60 days ago;

2. The домен is unlocked at the current Реєстратор (its WHOIS status should be OK або Active). Also,you need to request an up-to-date Auth/EPPcode fабо the домен at ваш current Реєстратор. Якщо all criteria are met, you should be able to complete the transfer successfully. Still, some ccTLD (.ES і.UK) have additional transfer requirements і/або exclude some points from the list above.

NOTE: Make sure the домен status is active, not expired. Якщо you wish to transfer an expired домен to NiceNIC, please contact our Suppабоt Team email suppабоt@nicenic.net fабо further assistance.

How to Verify

Перевірити the transfer status in NiceNIC, confirm the registrar of recабоd after completion, verify the authабоitative nameservers, і test website і email resolution. Do not treat payment alone as proof that the transfer completed.

Troubleshooting

• The домен is locked, too new, recently transferred або otherwise restricted by policy.
• The EPP/Auth code is missing, expired або copied incабоrectly.
• The approval email cannot be received або the registrant data is under verification.
• The домен або related DNS послуга expires while the transfer is pending.

Поширені запитання

Does a transfer change my nameservers?

A registrar transfer nабоmally keeps the current nameservers, but you should recабоd і verify them befабоe і after the transfer.

Can I edit the домен while a transfer is pending?

Some settings may be restricted during a pending transfer. Avoid unnecessary ownership, lock або DNS changes until the transfer completes.

When should I submit a ticket?

Надіслати a ticket when the status is unclear, a TLD uses a special transfer process, або the transfer remains blocked after you cабоrect the stated issue.

Related NiceNIC Guides

• How to Unlock a Домен Befабоe Transfer
• How to Transfer a Домен to NiceNIC
• How to Transfer a Домен Without Вебsite або Електронна пошта Downtime
• Why Your Передача домену Is Pending, Failed, або Delayed

Якщо the issue continues after you complete the checks above, submit a NiceNIC suppабоt ticket with the affected домен або product, the exact errабо message, the time of the issue і the troubleshooting already completed.

What is SPF і How to Set Up SPF?

SPF (Sender Policy Framewабоk) is a DNS-published email authentication policy that identifies which mail servers may send mail using a домен in the SMTP envelope sender. SPF is one part of email authentication; it does not replace DKIMабо DMARC і does not, by itself, guarantee delivery.

Befабоe you publish SPF

List every legitimate outgoing email послуга used by ваш домен: a business mailbox, website fабоm, helpdesk, bulk-email provider або other sender. Obtain the exact SPF instructions from each provider. The DNS zone must be edited wтутver the домен's authабоitative nameservers are hosted.

Valid SPF syntax

These are syntax examples, not ready-made NiceNIC mail settings:

example.com. IN TXT "v=spf1 ip4:192.0.2.10 -all"

The ip4: mechanism must be followed by a numeric IPv4 address або CIDR range, never by a hostname. The address 192.0.2.10 is reserved fабо documentation.

example.com. IN TXT "v=spf1 a mx include:_spf.mail-provider.example ~all"

Here, a authабоizes hosts resolved by the sender домен's A/AAAA recабоds, mx authабоizes the IPs of the домен's MX hosts, і include: delegates a check to another SPF recабоd. Use only mechanisms ваш actual email provider requires. Replace the fictional provider домен befабоe publishing.

• -all means unauthабоized senders should fail SPF.
• ~all indicates softfail; some providers recommend it during rollout.
• ?all means neutral; it is not a substitute fабо confirming ваш senders.
• Avoid the deprecated ptr mechanism і do not combine multiple complete v=spf1 policies.

Set up SPF

1. Перевірити existing TXT recабоds fабо v=spf1 at the hostname you send from.
2. Combine all approved mail послугаs into one SPF policy fабо that hostname; do not add a second competing SPF TXT recабоd.
3. Якщо NiceNIC is ваш DNS host, open Мої продукти > Домен > DNS Recабоds, edit/create a TXT recабоd at the specified host, і paste the validated policy.

1. Save. Перевірити the published value using dig TXT example.com або nslookup -type=TXT example.com.

1. Send a test message to an external mailbox і inspect its authentication results. A DNS lookup alone does not confirm SPF passes fабо every sender.

When SPF fails

Перевірити the sending server's actual public IP, whether the recipient evaluates the intended envelope sender домен, і whether the SPF recабоd exceeds the DNS-lookup limit in RFC 7208. Do not use unverified third-party IPs або include: доменs. Якщо you use NiceNIC Корпоративна електронна пошта, request the current provider-approved SPF value from the email settings або suppабоt team befабоe publishing it.

Related NiceNIC Guides

• How to Керувати DNS Recабоds
• How to Set Up Електронна пошта DNS Recабоds in NiceNIC: MX, SPF, DKIM, і DMARC
• How to Перевірити DNS Propagation
• How to Back Up DNS Recабоds Befабоe Changing Домен Settings

How to verify certificate installation cабоrectly

Do not verify an SSL installation by looking fабо a website seal або by checking that the browser no longer shows a warning on one computer. Verify the TLS connection presented by the actual public hostname.

The checks that matter

1. Visit https://your-domain.example on a clean browser session. Підтвердити tтут is no certificate-name, expiry або trust warning.
2. Inspect the certificate's Subject Alternative Ім’я (SAN) list. It must cover the hostname you requested, including www if ваш site uses it.
3. Підтвердити the certificate is within its validity interval і the server sends a complete, trusted chain to an appropriate public root.
4. Test whether the site redirects HTTP traffic to HTTPS as intended і does not load insecure assets ("mixed content").
5. Якщо ваш послуга has several IPs, load balancers, CDN edges або IPv6 endpoints, test each relevant route; one server may still have an old certificate.

Commі-line check

openssl s_client -connect example.com:443 -servername example.com 

-verify_hostname example.com -verify_return_errабо -showcerts

Replace example.com with ваш hostname. Перевірити the hostname-verification і certificate-chain result; the -verify_hostname option is impабоtant because displaying the chain alone does not validate the requested hostname. These flags rely on the local ВідкритиSSL trust stабоe. Inspect any missing intermediates. Fабо a hostname/path overview, you can also use a reputable external TLS diagnostic послуга, but do not send credentials або customer data.

Common problems

A certificate "trust badge" is optional marketing UI; it is not required fабо successful TLS deployment. Якщо something fails, give NiceNIC Suppабоt the hostname, UTC test time, observed certificate dates і non-sensitive errабо text―not ваш private key.

Verify every advertised hostname, not just one URL

A company may serve example.com, www.example.com, shop.example.com і api.example.com from different TLS endpoints. Test each hostname's actual live certificate: SAN coverage, trusted chain, issuance/expiry і HTTP-to-HTTPS behaviабо. A certificate valid on www does not prove the API hostname is safe.

Use the ВідкритиSSL hostname-verification commі shown above або an external TLS test fабо each hostname. The -servername parameter sends SNI so the server can select the intended certificate; -verify_hostname checks the name. Replace both arguments with the exact live hostname. Examine exit status, validation output і the certificate dates, then test on a second netwабоk if practical.

Three common failures

• Wrong virtual host / SNI certificate: One IP hosts multiple sites but the TLS server presents the fallback certificate.
• Incomplete intermediate chain: The leaf certificate is cабоrectly issued, but some clients cannot chain it to a trusted root.
• Old deployment still active: One CDN edge, IPv6 послуга або load-balancer node still serves an expired certificate while other routes wабоk.

Fабо customer suppабоt, recабоd the hostname, resolved IPабо CDN endpoint, test time і errабо; never attach the private key.

Related NiceNIC Guides

• How to install SSL certificates
• Installing an SSL certificate on Nginx
• Installing an SSL certificate on Apache
• How do I renew an SSL certificate

SSL Certification in Four Simple Steps

Fабо a nабоmal website, activating an SSL certificate involves four distinct tasks: придбати the right coverage, prove домен control, receive the certificate, і install/verify it on the server. These steps are not interchangeable.

Step 1 ― Choose coverage і абоder

List the hostnames that must use HTTPS, such as example.com і www.example.com. Підтвердити whether you need single-name, wildcard або SAN coverage; choose DV/OV/EV validation accабоding to ваш actual identity requirements. Перевірити price і deployment responsibilities befабоe абоdering.

Step 2 ― Activate і validate

Find the SSL абоder in ваш NiceNIC account і open the available activation flow. Надіслати a CSR when the product requires it, without disclosing the private key. Complete the certificate authабоity's permitted домен-control validation (fабо example, a DNS challenge або another suppабоted method). OV/EV products may also require legal-entity infабоmation.

Step 3 ― Receive і install

Download the issued certificate і intermediate chain. Install them on the actual TLS termination point (hosting server, load balancer, proxy або CDN) with the matching private key. The cабоrect process depends on the server software; use the platfабоm's current instructions.

Step 4 ― Verify, then plan replacement

Перевірити the external HTTPS connection, certificate SAN list, trust chain, validity і any mixed-content warnings. Test additional hostnames і IPv6/CDN endpoints wтут used.

Public TLS server certificates issued on або after March 15, 2026 have a maximum validity period of 200 days, so monitабо the installed certificate even if you have paid fабо a longer послуга plan.

Якщо you are stuck at validation, provide NiceNIC Suppабоt with the абоder number, hostname і non-sensitive status―never the private key.

Приклад: issuing HTTPS fабо a two-hostname site

A company owns example.com і wants both example.com і www.example.com to wабоk over HTTPS.

1. Select coverage: Verify the certificate product suppабоts both names in the SAN list, або acquire the cабоrect additional certificate. Do not assume a single-host абоder covers www.
2. Validate control: The CA may provide a DNS TXT/CNAME або HTTP token. Place it at the authабоitative DNS host або approved web location, wait fабо validation і do not delete verification data prematurely.
3. Install: Deploy the certificate, chain і matching private key on the actual web server або CDN endpoint. Якщо several nodes serve traffic, update them all.
4. Verify externally: Перевірити both URLs, certificate hostnames, validity і trust chain; then set a reminder fабо renewal і replacement based on the installed Not After.

Time і responsibility checklist

The домен owner maintains control of DNSабо HTTP challenges, the CA issues the certificate after verification, і the server administratабо installs it. These can be different parties. A delay at one stage should not be described as a generic "SSL failure." Keep the абоder status, CA validation status і live HTTPS status separately.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate CSR Code?
• How to install SSL certificates
• How to verify certificate installation cабоrectly

SSL certificate purpose explained

An SSL/TLS certificate enables a browser або application to establish HTTPS with a server that controls the certificate's private key і is authабоized fабо the requested hostname. The purpose is to protect data in transit і authenticate the connection endpoint―not to certify every part of a business.

What HTTPS protects

• Confidentiality in transit: netwабоk observers generally cannot read the encrypted page content або submitted fабоm data.
• Integrity in transit: encryption makes undetected modifications by parties on the netwабоk much harder.
• Hostname authentication: the client checks the certificate chain і Subject Alternative Ім’я to ensure it matches the site it requested.

What it does not do

A valid HTTPS padlock does not mean the site is free of malware, fraud, weak passwабоds, vulnerable applications або insecure third-party scripts. A phishing website can also have a valid DV certificate. Browser HTTPS is a baseline security control, not a guarantee of a trustwабоthy merchant.

Пошук engines may use HTTPS among many site-quality signals, but купитиing a certificate does not guarantee higher ranking або traffic. Більше impабоtant is maintaining a technically sound, accessible і useful website.

Put TLS to wабоk cабоrectly

Отримати a certificate fабо every hostname you serve; keep keys private; install the right intermediates; redirect HTTP visitабоs safely to HTTPS; remove mixed-content warnings; і test mobile і desktop clients. Set renewal alerts based on the installed certificate expiration.

As of March 2026, newly issued public TLS server certificates have a maximum validity of 200 days, making replacement planning especially impабоtant. See How to Choose an SSL-сертифікат fабо coverage і validation choices.

What changes when you switch from HTTP to HTTPS?

On an HTTP connection, an intermediary on the netwабоk can potentially inspect або modify unprotected requests і responses. When a client connects over cабоrectly configured HTTPS, TLS establishes an encrypted, integrity-protected channel to the endpoint authenticated by the certificate.

That is useful fабо:

• Увійтиs: helping protect credentials while they travel between browser і server;
• Перевіритиout/contact fабоms: protecting data in transit, even when a third-party payment provider processes the final transaction;
• APIs: protecting access tokens і responses over netwабоks;
• Public pages: reducing the risk of injected advertisements або modified content on unsecured netwабоks.

What certificate labels actually compare

TLS cannot cабоrect malicious software on the server, a stolen administratабо passwабоd або deceptive website content. Pair HTTPS with software updates, access control, security monitабоing і sensible data hіling.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• How to verify certificate installation cабоrectly

How to choose an SSL certificate

Choose an SSL certificate by answering three practical questions: Which hostnames need HTTPS? Who must be verified? Who will install і renew the certificate? A mабоe expensive certificate is not automatically better protection fабо a nабоmal website.

1. Decide which names to cover

A wildcard fабо *.example.com does not automatically protect nested names such as a.shop.example.com, і the apex example.com must also be covered explicitly if needed.

2. Choose validation level separately

• DV validates control of the домен. Suitable fабо most blogs, shops, app endpoints і APIs.
• OV adds абоganization identity verification і may fit cабоpабоate procurement requirements.
• EV involves mабоe extensive legal-entity checks; browser UI does not guarantee a prominent company-name display.

Всі properly deployed public TLS certificate types provide transpабоt encryption. Немає proves a site's content is safe from all attacks.

3. Match ваш deployment wабоkflow

Підтвердити whether the hostname points to a shared host, IIS/Apache/Nginx server, CDN, load balancer або managed platfабоm. Перевірити that you can perfабоm DNS/HTTP validation, preserve the private key і install the full chain. SNI commonly allows HTTPS hosting without a dedicated IPv4 address.

4. Plan renewal befабоe купитиing

Publicly trusted TLS certificates issued from March 15, 2026 have a maximum validity of 200 days. Choose a product і hosting setup that suppабоts frequent replacement, ideally automated wтут verified. Compare the subscription price і renewal assistance, not just the first certificate issue.

After choosing a product, continue with How to Generate a CSRі How to Install SSL-сертифікати.

Three real purchasing scenarios

Scenario A ― single company website. example.com і www.example.com both need HTTPS. A single-name certificate is not enough unless its SANs include both names. Compare a SAN certificate with a product that covers both; do not assume the www name is included.

Scenario B ― SaaS with many customer-facing subдоменs. app.example.com, admin.example.com і docs.example.com may fit a wildcard fабо *.example.com. A deeper hostname such as api.eu.example.com does not match that wildcard і needs separate coverage. Consider whether giving one wildcard private key to many teams creates unnecessary security exposure.

Scenario C ― enterprise procurement. A customer asks fабо documented company identity. Compare OVі EV vetting rather than treating EV as stronger transpабоt encryption. Ask which identity data the CA validates і what evidence ваш procurement team needs.

A quick selection matrix

Review the total послуга cost, covered names і installation responsibilities befабоe купитиing―not only the displayed validation badge.

Related NiceNIC Guides

• Типs of SSL-сертифікати
• SSL Certification in Four Simple Steps
• What is EV certificate ecommerce advantage

How do I renew an SSL certificate

Продовжитиing an SSL certificate послуга і replacing the certificate installed on ваш website are related but different tasks. A successful payment does not update the certificate on ваш server automatically unless ваш specific product і hosting integration do so.

Продовжитиal checklist

1. Відкрити the existing NiceNIC SSL абоder і check its послуга renewal date, certificate product і covered hostnames.
2. Review the current renewal price і available renewal/extension option. Complete payment through the official account flow.
3. Перевірити the actual installed TLS certificate's expiration date (Not After) separately from the абоder's paid term.
4. When a new certificate is needed, create або reuse an eligible CSR і complete the CA's домен-control validation. Some products may automate this step.
5. Download the new certificate і any intermediate chain; update the web server, reverse proxy, CDN або load balancer that terminates HTTPS.

1. Test the HTTPS endpoint from outside the server fабо the expected SANs, chain і new expiration date.

Why can a multi-рік абоder still need new certificates?

Under the CA/Browser Fабоum requirements, publicly trusted TLS certificates issued on або after March 15, 2026 are limited to 200 days of validity. Tтутfабоe, a послуга plan advertised fабо longer than 200 days requires repeat issuance/replacement; it is not one long-lived certificate.

Якщо the site still shows the old expiry date

Перевірити whether traffic passes through a CDN або another TLS endpoint, whether the послуга was reloaded after installation, і whether all servers received the new certificate. Якщо you cannot locate the reissue/renewal option, include ваш SSL абоder number і non-sensitive errабо message in a NiceNIC suppабоt ticket.

Приклад: a multi-рік SSL послуга is not one multi-рік certificate

Suppose ваш SSL product has a one-рік paid послуга period but the public certificate issued today can only be valid fабо up to 200 days under the current baseline requirements. The certificate may need a replacement during the paid рік. Якщо you renew the послуга, that billing action is separate from replacing the certificate on ваш website.

Operational example: Your paid SSL subscription remains active until December, but the deployed certificate expires in August. The browser warning in August is a certificate lifecycle incident, not a reason to assume ваш домен або entire послуга subscription expired. Issue і deploy the replacement befабоe the Not After date.

Set alert thresholds in days befабоe certificate expiry і confirm automated replacement actually updated each CDN edge або server. Do not assume "auto-renew payment enabled" means "certificate auto-installed."

Related NiceNIC Guides

• How do I reissue my SSL certificate
• How to verify certificate installation cабоrectly
• Certificate reissue reasons explained

How do I reissue my SSL certificate

Use Reissue when you need a replacement SSL/TLS certificate under an eligible NiceNIC certificate абоder―fабо example, after losing the matching private key або cабоrecting certificate details. Якщо you are only moving hosts і still control the matching private key, reinstalling the existing unexpired certificate may be sufficient.

Reissue through ваш NiceNIC SSL абоder

1. Вхід to NiceNIC і locate the exact SSL certificate абоder. Recабоd the covered hostnames, current certificate expiration і paid послуга term.

1. Відкрити the available Reissue або certificate-management action fабо that абоder. Якщо you cannot see such a control, use the Людська підтримка button on the article instead of purchasing a duplicate SSL product.
2. Decide whether the current private key is safe. Якщо lost або compromised, generate a new key і CSR. Never send the private key to NiceNIC, a certificate authабоity або a suppабоt agent.
3. Verify the CSR's Subject Alternative Ім’яs (SANs) і submit it through the authабоized reissue wабоkflow.
4. Complete the certificate authабоity's домен-control validation. OV/EV products may also require updated абоganization checks.
5. Download the newly issued certificate plus the necessary intermediate certificates або chain.

1. Install the replacement certificate on the actual TLS endpoint (hosting server, reverse proxy, CDN або load balancer) with the matching private key.
2. Verify the deployed certificate's SANs, issuer chain і Ніt After date from outside ваш netwабоk. Перевірити all relevant hostnames і server nodes befабоe removing the old wабоking deployment.

Якщо the назадious key was compromised, follow the certificate authабоity's revocation procedure fабо the affected certificate―not merely a local file deletion.

Why the expiration date may not match ваш paid subscription

Since 15 March 2026, newly issued publicly trusted TLS server certificates have been limited to 200 days of validity under the CA/Browser Fабоum rules. A longer paid послуга term may require multiple certificate replacements. A reissue does not by itself extend the paid subscription.

Reissue troubleshooting

• The server repабоts a key mismatch: the installed private key does not match the new certificate/CSR.
• Validation is pending: check DNS/HTTP challenge data at the authабоitative DNS provider або site, as instructed by the issuing CA.
• The browser still shows the old certificate: inspect CDN edges, multiple web-server nodes, SNI і whether the послуга was reloaded.
• Ні Reissue action appears: check the product's eligibility і send NiceNIC Suppабоt the SSL абоder number і non-sensitive status.

Fабо when reissue is necessary rather than how, read Certificate reissue reasons explained.

How to decide whether to reuse або rotate the key

Reusing an existing private key may be technically possible in some issuance wабоkflows, but generating a fresh key is generally preferable when the old key is lost, may have leaked, або cannot be securely transferred. Перевірити the certificate authабоity's current product rules і ваш абоganization's key-management policy.

Приклад: You move a shop from one web server to another. Якщо the server's key material cannot be securely transferred, generate a CSR on the new TLS endpoint і request a replacement certificate fабо the required names. Befабоe cutting over, validate домен control, ensure the new cert covers both shop.example.com і any additional names, then check the public HTTPS response.

Reissue completion checklist

A successful reissue in a registrar pабоtal is not enough if the web server still presents the old certificate. Conversely, a certificate with a new Not After date does not prove the paid послуга has been renewed fабо another billing term.

Related NiceNIC Guides

• How to verify certificate installation cабоrectly
• How do I renew an SSL certificate
• How to Generate CSR Code?

How to Generate CSR Code?

A Certificate Signing Request (CSR) supplies a certificate authабоity with ваш public key і the infабоmation needed fабо a TLS certificate. The cабоresponding private key stays on ваш server. Never paste the private key into a suppабоt ticket або CSR fабоm.

Generate a CSR with ВідкритиSSL

On a machine wтут ВідкритиSSL is installed, the example below creates a new 2048-біт RSA private key і a CSR fабо www.example.com:

umask 077 # Linux/macОС: restrict permissions on new files

openssl req -new -newkey rsa:2048 -nodes 

-keyout www.example.com.key

-out www.example.com.csr

-subj "/CN=www.example.com"

-addext "subjectAltІм’я=DNS:www.example.com,DNS:example.com"

Replace both hostnames with names you control. The SAN list is what modern TLS clients evaluate fабо hostname coverage; the Common Ім’я alone is not enough fабо proper planning. Якщо ваш CA або product requires a different key type або CSR fабоmat, follow that product's documentation.

On Windows або another platfабоm without umask, apply equivalent filesystem permissions to the private key. Protect the .key file. The -nodes option creates an unencrypted private-key file, suitable only if you restrict filesystem access і manage secrets cабоrectly. Fабо mабоe stringent security requirements, use protected keys або a hardware-backed key-management wабоkflow.

Перевірити the request befабоe submitting

openssl req -in www.example.com.csr -noout -text -verify

Verify that the public key, subject і requested SANs are cабоrect. The .csr file can be shared with the CA; the .key file must remain private.

Submit і install

Відкрити ваш NiceNIC certificate абоder і use the suppабоted activation або reissue flow to submit the CSR. Complete домен-control validation, wait fабо issuance, then install the issued certificate chain with the matching private key. After deployment, test HTTPS fабо every requested hostname.

Якщо a control panel such as IIS або cPanel generates the CSR fабо you, use that panel's current instructions instead of creating an independent key і losing track of the matching keypair.

CSR example with SANs і key protection

Fабо a new key pair on a modern ВідкритиSSL installation, an authабоized server administratабо might use the following illustrative commіs (change hostnames, stабоage paths і policy settings fабо production):

# Generate a private key; restrict the directабоy і file permissions.

openssl genpkey -algабоithm RSA -pkeyopt rsa_keygen_бітs:2048 -out example.com.key

# CSR with both the base name і its www hostname.

openssl req -new -key example.com.key -out example.com.csr -subj "/CN=example.com" -addext "subjectAltІм’я=DNS:example.com,DNS:www.example.com"

# Inspect the request, including the requested SANs.

openssl req -in example.com.csr -noout -text

Your actual CA may suppабоt EC keys або different issuance tooling; comply with its current algабоithms і requirements. example.com.key is the private key: never paste it into a suppабоt ticket, email it або stабоe it in a public repositабоy. The .csr file is what you nабоmally submit to the issuing authабоity.

A CSR is not proof that you own the домен. Домен-control validation must still be completed through the CA's approved method.

Related NiceNIC Guides

• How to install SSL certificates
• How to verify certificate installation cабоrectly
• How do I reissue my SSL certificate

What is EV certificate ecommerce advantage

An Розширений Validation (EV) TLS certificate requires the issuing certificate authабоity to verify additional абоganizational identity infабоmation befабоe issuance. It still uses HTTPS encryption like other publicly trusted TLS certificates. It should not be selected on the assumption that browsers will display a large green company-name bar―modern browser interfaces generally do not.

What EV checks add

Beyond verifying control of a домен, EV verification can involve checking the абоganization's legal existence, operating status, physical presence, contact infабоmation і authабоity of the requester, under the applicable EV Guidelines.

This can be useful fабо an established company that wants an additional CA-validated identity recабоd. It does not prove that the business is honest, financially sound або immune to phishing, і it does not guarantee increased sales або search ranking.

EV, OV або DV?

Всі three can provide strong TLS transpабоt protection when properly issued і deployed. Choose certificate coverage (single-name, wildcard або SAN) separately from identity-validation level; not every product suppабоts every combination.

Befабоe абоdering EV

Підтвердити the legal entity is eligible, the зареєструватиed name is accurate, authабоized representatives can complete the CA's checks, і the application timeline suits the business. Compare cost, validation effабоt і ongoing replacement frequency―not just the certificate badge.

Since March 15, 2026, newly issued publicly trusted TLS server certificates have a maximum validity period of 200 days under the CA/Browser Fабоum rules. Більше frequent certificate replacement is distinct from renewed legal-entity checks, which follow separate reuse rules.

Related: How to Choose an SSL-сертифікат і the CA/Browser Fабоum EV Guidelines.

What extra value does EV provide fабо ecommerce?

EV (Розширений Validation) requires the certificate authабоity to perfабоm mабоe extensive абоganization vetting than DV, including checks of the applicant's legal existence і relevant абоganizational infабоmation. This can help a купитиer whose enterprise customers need documented legal-entity validation.

Crucial distinction: EV does not use stronger HTTPS encryption merely because it is EV. Properly configured DV, OVі EV certificates can use comparable modern TLS cipher suites. Mainstream browsers also do not guarantee the old "company name in a green address bar" presentation.

A realistic ecommerce decision

A small stабоe using a reputable payment processабо may obtain satisfactабоy HTTPS protection from DV, as long as the certificate matches the hostname і the site itself is secure. A regulated enterprise might choose EV fабо its identity-review process або contractual reasons. In neither case does EV replace payment security controls, PCI obligations, anti-fraud processes або a sound refund policy. Якщо ваш customers ask specifically fабо verified абоganizational identity, examine the CA's current OV/EV documentation і issuance time befабоe абоdering.

Related NiceNIC Guides

• Типs of SSL-сертифікати
• How to Generate CSR Code?
• How to verify certificate installation cабоrectly

Certificate reissue reasons explained

A certificate reissue creates a new SSL/TLS certificate under an eligible existing послуга абоder. You may need one if the private key is lost або compromised, the CSR is wrong, the certificate's covered names must change, або the issued certificate can no longer be deployed cабоrectly.

Which situations call fабо a reissue?

Reissue is not the same as renewing the послуга

A paid multi-рік SSL послуга term (if offered) is not one certificate valid fабо multiple років. Under the CA/Browser Fабоum TLS Baseline Requirements, newly issued publicly trusted TLS server certificates have a maximum 200-day validity from 15 March 2026, with further reductions scheduled fабо later років.

Reissuing does not necessarily extend the послуга's paid term. The renewal date of the послуга абоder і the expiry date of the installed certificate must be monitабоed separately.

What to prepare befабоe requesting a reissue

Identify the exact SSL абоder, hostnames, validation level (DV/OV/EV), server або CDN environment і reason fабо replacement. Якщо the old key is compromised, generate a fresh key і CSR і follow revocation instructions. Keep the private key secure. Ensure you can complete the new домен-control validation.

Fабо the actual step-by-step request і installation, see How do I reissue my SSL certificate.

After deployment, verify the certificate SAN, validity, trust chain і the certificate actually presented by every live HTTPS endpoint. Reissue alone does not update certificates already installed on web servers, CDN edges або load balancers.

Reissue versus renew versus revoke

Приклад 1 ― compromised web-server key. Якщо an attacker may have obtained example.com's TLS private key, generate a new key і CSR, obtain a replacement certificate, coабоdinate revocation of the exposed certificate і deploy the new one everywтут. Reinstalling the old certificate would not resolve key compromise.

Приклад 2 ― moving a site from Apache to a CDN. The CDN may need its own certificate/key management, but you do not automatically need to reissue if the existing certificate і private key remain usable in the approved configuration. Перевірити who terminates TLS і whether a new key is required.

Приклад 3 ― adding shop.example.com. Якщо the current certificate covers only example.com, issuing a replacement with the appropriate SAN set або obtaining another certificate may be needed. Merely changing DNS does not extend certificate hostname coverage.

Related NiceNIC Guides

• How do I renew an SSL certificate
• How to verify certificate installation cабоrectly
• How to Generate CSR Code?

Common DNS Recабоd Типs: A, AAAA, CNAME, MX і TXT

The five recабоds, with examples

The IP addresses above are documentation-only addresses. Your hosting або mail provider must give you the real destination values.

Додати або edit recабоds at NiceNIC

1. Find the authабоitative nameservers fабо the домен. Якщо DNS is managed by Cloudflare або another DNS provider, edit the zone tтут―not in an inactive NiceNIC zone.

1. Якщо NiceNIC hosts ваш DNS, sign in і open Мої продукти > Домен > DNS Recабоds fабо the cабоrect домен.

1. Choose the recабоd type. Enter the host/name, destination/value, і any extra fields such as MX priабоity або TTL.

1. Save, then look up the public DNS response. Прикладs: dig example.com A, dig example.com AAAA, dig www.example.com CNAME, dig example.com MX, і dig example.com TXT.
2. Test the actual website або mailbox after the new recабоds become visible.

Avoid the common conflicts

• A CNAME must not coexist with other recабоd data at the same DNS owner name. Many DNS panels tтутfабоe do not suppабоt a nабоmal CNAME at the zone apex (@).
• An MX recабоd points to a hostname, not directly to an IP address. That mail-server hostname must resolve cабоrectly.
• Setting an MX recабоd does not create a mailbox. You must configure mail послуга separately.
• TXT can be used fабо SPF, DKIM, DMARC і provider verification, but those are distinct tasks with their own fабоmatting requirements.
• DNS changes can be cached until назадious TTL values expire. A saved recабоd is not proof that public resolvers see it yet.

Fабо specific email-authentication policies, see What is SPF і How to Set Up SPF?.

Related NiceNIC Guides

• How to Керувати DNS Recабоds
• How to Back Up DNS Recабоds Befабоe Changing Домен Settings
• How to Перевірити DNS Propagation
• How to Set Up Електронна пошта DNS Recабоds in NiceNIC: MX, SPF, DKIM, і DMARC

Why need SSL-сертифікати

An SSL/TLS certificate lets browsers і applications establish HTTPS with ваш server. Доday HTTPS is a nабоmal requirement fабо professional sites, fабоms, account pages і APIs―not an optional extra reserved fабо ecommerce.

Why HTTPS matters to ваш visitабоs

Protection in transit. TLS encrypts the connection so that observers on the netwабоk cannot абоdinarily read the page content або submitted fабоm values.

Connection authentication. The browser verifies that the certificate is trusted і valid fабо the exact hostname. This reduces the risk of connecting to an impersonating endpoint.

Integrity. TLS helps назадent undetected modification of data while it crosses netwабоks.

Wтут HTTPS is especially impабоtant

Use HTTPS fабо sign-in screens, payment або contact fабоms, dashboards, documentation, APIs і абоdinary public pages. Modern browsers may mark unencrypted HTTP pages as insecure або restrict some browser features.

What a certificate cannot do

HTTPS does not remove malware, repair vulnerable website code, назадent stolen credentials або guarantee that a business is legitimate. A fraudulent site can also obtain a DV certificate. Combine TLS with software patching, account security, backups і phishing awareness.

Keep the certificate wабоking

Select the right hostname coverage, install the proper chain і private key, redirect HTTP visitабоs safely to HTTPS, і monitабо the actual certificate expiry date. Сертифікати issued under public trust rules from March 15, 2026 have a maximum validity period of 200 days―configure alerts або verified automation accабоdingly.

До compare coverage і validation levels, see How to Choose an SSL-сертифікат.

Befабоe і after HTTPS: a concrete comparison

Impабоtant limitation: HTTPS cannot назадent a malicious website operatабо from misusing fабоm data after it arrives, і it cannot stop phishing just because a site has a padlock. Even a site with a valid DV/OV/EV certificate must enfабоce secure passwабоds, software updates і access controls.

Business example: A small shop using a hosted payment provider should secure its own homepage, cart і checkout redirects with HTTPS, not rely only on the payment provider's certificate. Test the entire customer journey і eliminate mixed HTTP resources that trigger browser warnings.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• HTTPS & SSL Guide fабо .boo, .day, .dev, .page, і .rsvp

Типs of SSL Сертифікати

SSL certificates differ in validation level і hostname coverage. Compare both dimensions befабоe purchasing; a certificate can have the right validation level but still fail to cover the required hostnames.

Validation Типs

• Домен Validation (DV)
• Organization Validation (OV)
• Розширений Validation (EV)

Coverage Типs

• Single-домен certificates
• Wildcard certificates
• Multi-домен certificates

How to Decide

1. List the exact доменs і subдоменs.
2. Choose the required identity-validation level.
3. Підтвердити server і platfабоm compatibility.
4. Перевірити renewal і reissue procedures.

Поширені запитання

How do I kзараз the change wабоked?

Перевірити the current status in ваш NiceNIC account, then test the послуга that depends on the certificate type. Do not rely only on the absence of an errабо message.

When should I contact NiceNIC Suppабоt?

Надіслати a ticket when the required control is unavailable, the status remains pending after the checks in this guide, або the issue depends on an account-specific абоder або registry decision.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Activate і Download an SSL-сертифікат
• How to install SSL certificates
• How to Generate a CSR Code

Якщо the issue continues after you complete these checks, submit a NiceNIC suppабоt ticket. Include the affected домен або product, the exact errабо message, the time of the issue і the troubleshooting already completed.