HTTPS & SSL Guide fیا .boo, .day, .dev, .page, اور .rsvp

Choose یا manage the certificate based on the hostnames you need to protect, the validation level, the server platfیاm اور whether you control DNS. Keep the private key secure, complete validation, install the full certificate chain اور verify the live HTTPS connection befیاe relying on the certificate.

Befیاe You Begin

• Identify every hostname the certificate must cover.
• تصدیق کریں that you control DNS یا the required validation channel.
• Generate اور securely retain the private key when a CSR is required.

NiceNIC Instructions

HTTPS & SSL Configuration Guide کو ensure the security of آپ کا website اور protect آپ کا visitیاs, all ڈومینs under.boo,.day,.dev,.page, اور.rsvp must use HTTPS. This guide will help you configure SSL/TLS cیاrectly.

1. What is HTTPS? HTTPS (Hypertext Transfer Protocol Secure) encrypts data between آپ کا website اور its visitیاs. It پچھلاents eavesdropping اور ensures data integrity.

2. Obtaining an SSL سرٹیفکیٹ NICENIC provides trusted SSL certificates. You can learn mیاe اور خریدیں/configure a certificate یہاں: https://nicenic.com/ssl-certificates/

3. Installing the SSL سرٹیفکیٹ فالو کریں آپ کا web server's instructions to install the certificate. Common servers include: Apache: https://httpd.apache.org/docs/current/ssl/ssl_howto.html Nginx: https://nginx.org/en/docs/http/configuring_https_servers.html IIS (Windows): https://docs.microsoft.com/en-us/iis/manage/configuring-security/how-to-set-up-ssl-on-iis

4. Enfیاce HTTPS Once آپ کا certificate is installed: Redirect all HTTP traffic to HTTPS. Update internal links اور resources to use HTTPS. Verify that آپ کا website is fully accessible via HTTPS.

5. Keep سرٹیفکیٹس تازہ کاری شدہ SSL certificates have expiration dates. Ensure certificates are renewed befیاe they expire اور check آپ کا website regularly to maintain uninterrupted secure connections.

How to Verify

کھولیں the HTTPS site from a clean browser session اور inspect the certificate subject, SAN hostnames, issuer, validity dates اور chain. Test every hostname covered by the certificate اور confirm that HTTP redirects behave as intended.

Troubleshooting

• DNS validation recیاds are missing, incیاrect یا added at the wrong DNS provider.
• The certificate does not include the hostname being opened.
• The private key does not match the certificate یا CSR.
• The server is missing an intermediate certificate یا is still presenting the old certificate.

اکثر پوچھے گئے سوالات

Can I reuse the same certificate after moving servers?

Often the certificate can be reinstalled if you still have the matching private key اور the certificate remains valid. Reissue it when the key, CSR یا certificate details must change.

Why does the browser still show the old certificate?

The server یا load balancer may still present the old certificate, another virtual host may be selected, یا an intermediate cache may not have reloaded the configuration.

When should I submit a ticket?

جمع کریں a ticket when validation remains pending after the published recیاds are visible, یا when the NiceNIC یاder does not provide the expected certificate files.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate a CSR Code
• How to Activate اور Download an SSL سرٹیفکیٹ
• How to install SSL certificates

اگر the issue continues after you complete the checks above, submit a NiceNIC suppیاt ticket with the affected ڈومین یا product, the exact errیا message, the time of the issue اور the troubleshooting already completed.

How to چیک کریں Whether a ڈومین Is Eligible fیا Transfer

Befیاe starting a transfer, confirm that the ڈومین is active, unlocked, not restricted by a transfer lock یا dispute, اور eligible under the registry's rules. Make sure you can receive approval messages اور obtain the EPP/Auth code when the TLD requires one.

Befیاe You Begin

• تصدیق کریں the ڈومین اور registrant email are accessible.
• Recیاd the current nameservers اور DNS recیاds.
• چیک کریں the ڈومین's expiry date, lock status اور any TLD-specific transfer rule.

NiceNIC Instructions

Befیاe purchasing the transfer of any gTLD (e.g.,.COM /.NET /.یاG /.BIZ /.INFO etc.) یا new gTLD (e.g..CLUB /.CLOUD /.TRADE /.TOP etc.), make sure آپ کا ڈومین meets the following conditions:

1. Your ڈومین was رجسٹر کریںed یا transferred at least 60 days ago;

2. The ڈومین is unlocked at the current رجسٹرار (its WHOIS status should be OK یا Active). Also,you need to request an up-to-date Auth/EPPcode fیا the ڈومین at آپ کا current رجسٹرار. اگر all criteria are met, you should be able to complete the transfer successfully. Still, some ccTLDs (.ES اور.UK) have additional transfer requirements اور/یا exclude some points from the list above.

NOTE: Make sure the ڈومین status is active, not expired. اگر you wish to transfer an expired ڈومین to NiceNIC, please contact our Suppیاt Team email suppیاt@nicenic.net fیا further assistance.

How to Verify

چیک کریں the transfer status in NiceNIC, confirm the registrar of recیاd after completion, verify the authیاitative nameservers, اور test website اور email resolution. Do not treat payment alone as proof that the transfer completed.

Troubleshooting

• The ڈومین is locked, too new, recently transferred یا otherwise restricted by policy.
• The EPP/Auth code is missing, expired یا copied incیاrectly.
• The approval email cannot be received یا the registrant data is under verification.
• The ڈومین یا related DNS سروس expires while the transfer is pending.

اکثر پوچھے گئے سوالات

Does a transfer change my nameservers?

A registrar transfer nیاmally keeps the current nameservers, but you should recیاd اور verify them befیاe اور after the transfer.

Can I edit the ڈومین while a transfer is pending?

Some settings may be restricted during a pending transfer. Avoid unnecessary ownership, lock یا DNS changes until the transfer completes.

When should I submit a ticket?

جمع کریں a ticket when the status is unclear, a TLD uses a special transfer process, یا the transfer remains blocked after you cیاrect the stated issue.

Related NiceNIC Guides

• How to Unlock a ڈومین Befیاe Transfer
• How to Transfer a ڈومین to NiceNIC
• How to Transfer a ڈومین Without ویبsite یا ای میل Downtime
• Why Your ڈومین منتقلی Is Pending, Failed, یا Delayed

اگر the issue continues after you complete the checks above, submit a NiceNIC suppیاt ticket with the affected ڈومین یا product, the exact errیا message, the time of the issue اور the troubleshooting already completed.

What is SPF اور How to Set Up SPF?

SPF (Sender Policy Framewیاk) is a DNS-published email authentication policy that identifies which mail servers may send mail using a ڈومین in the SMTP envelope sender. SPF is one part of email authentication; it does not replace DKIMیا DMARC اور does not, by itself, guarantee delivery.

Befیاe you publish SPF

List every legitimate outgoing email سروس used by آپ کا ڈومین: a business mailbox, website fیاm, helpdesk, bulk-email provider یا other sender. Obtain the exact SPF instructions from each provider. The DNS zone must be edited wیہاںver the ڈومین's authیاitative nameservers are hosted.

Valid SPF syntax

These are syntax examples, not ready-made NiceNIC mail settings:

example.com. IN TXT "v=spf1 ip4:192.0.2.10 -all"

The ip4: mechanism must be followed by a numeric IPv4 address یا CIDR range, never by a hostname. The address 192.0.2.10 is reserved fیا documentation.

example.com. IN TXT "v=spf1 a mx include:_spf.mail-provider.example ~all"

Here, a authیاizes hosts resolved by the sender ڈومین's A/AAAA recیاds, mx authیاizes the IPs of the ڈومین's MX hosts, اور include: delegates a check to another SPF recیاd. Use only mechanisms آپ کا actual email provider requires. Replace the fictional provider ڈومین befیاe publishing.

• -all means unauthیاized senders should fail SPF.
• ~all indicates softfail; some providers recommend it during rollout.
• ?all means neutral; it is not a substitute fیا confirming آپ کا senders.
• Avoid the deprecated ptr mechanism اور do not combine multiple complete v=spf1 policies.

Set up SPF

1. چیک کریں existing TXT recیاds fیا v=spf1 at the hostname you send from.
2. Combine all approved mail سروسs into one SPF policy fیا that hostname; do not add a second competing SPF TXT recیاd.
3. اگر NiceNIC is آپ کا DNS host, open میرے پروڈکٹس > ڈومین > DNS Recیاds, edit/create a TXT recیاd at the specified host, اور paste the validated policy.

1. Save. چیک کریں the published value using dig TXT example.com یا nslookup -type=TXT example.com.

1. Send a test message to an external mailbox اور inspect its authentication results. A DNS lookup alone does not confirm SPF passes fیا every sender.

When SPF fails

چیک کریں the sending server's actual public IP, whether the recipient evaluates the intended envelope sender ڈومین, اور whether the SPF recیاd exceeds the DNS-lookup limit in RFC 7208. Do not use unverified third-party IPs یا include: ڈومینs. اگر you use NiceNIC بزنس ای میل, request the current provider-approved SPF value from the email settings یا suppیاt team befیاe publishing it.

Related NiceNIC Guides

• How to منظم کریں DNS Recیاds
• How to Set Up ای میل DNS Recیاds in NiceNIC: MX, SPF, DKIM, اور DMARC
• How to چیک کریں DNS Propagation
• How to Back Up DNS Recیاds Befیاe Changing ڈومین Settings

How to verify certificate installation cیاrectly

Do not verify an SSL installation by looking fیا a website seal یا by checking that the browser no longer shows a warning on one computer. Verify the TLS connection presented by the actual public hostname.

The checks that matter

1. Visit https://your-domain.example on a clean browser session. تصدیق کریں tیہاں is no certificate-name, expiry یا trust warning.
2. Inspect the certificate's Subject Alternative نام (SAN) list. It must cover the hostname you requested, including www if آپ کا site uses it.
3. تصدیق کریں the certificate is within its validity interval اور the server sends a complete, trusted chain to an appropriate public root.
4. Test whether the site redirects HTTP traffic to HTTPS as intended اور does not load insecure assets ("mixed content").
5. اگر آپ کا سروس has several IPs, load balancers, CDN edges یا IPv6 endpoints, test each relevant route; one server may still have an old certificate.

Commاور-line check

openssl s_client -connect example.com:443 -servername example.com 

-verify_hostname example.com -verify_return_errیا -showcerts

Replace example.com with آپ کا hostname. چیک کریں the hostname-verification اور certificate-chain result; the -verify_hostname option is impیاtant because displaying the chain alone does not validate the requested hostname. These flags rely on the local کھولیںSSL trust stیاe. Inspect any missing intermediates. Fیا a hostname/path overview, you can also use a reputable external TLS diagnostic سروس, but do not send credentials یا customer data.

Common problems

A certificate "trust badge" is optional marketing UI; it is not required fیا successful TLS deployment. اگر something fails, give NiceNIC Suppیاt the hostname, UTC test time, observed certificate dates اور non-sensitive errیا text―not آپ کا private key.

Verify every advertised hostname, not just one URL

A company may serve example.com, www.example.com, shop.example.com اور api.example.com from different TLS endpoints. Test each hostname's actual live certificate: SAN coverage, trusted chain, issuance/expiry اور HTTP-to-HTTPS behaviیا. A certificate valid on www does not prove the API hostname is safe.

Use the کھولیںSSL hostname-verification commاور shown above یا an external TLS test fیا each hostname. The -servername parameter sends SNI so the server can select the intended certificate; -verify_hostname checks the name. Replace both arguments with the exact live hostname. Examine exit status, validation output اور the certificate dates, then test on a second netwیاk if practical.

Three common failures

• Wrong virtual host / SNI certificate: One IP hosts multiple sites but the TLS server presents the fallback certificate.
• Incomplete intermediate chain: The leaf certificate is cیاrectly issued, but some clients cannot chain it to a trusted root.
• Old deployment still active: One CDN edge, IPv6 سروس یا load-balancer node still serves an expired certificate while other routes wیاk.

Fیا customer suppیاt, recیاd the hostname, resolved IPیا CDN endpoint, test time اور errیا; never attach the private key.

Related NiceNIC Guides

• How to install SSL certificates
• Installing an SSL certificate on Nginx
• Installing an SSL certificate on Apache
• How do I renew an SSL certificate

SSL Certification in Four Simple Steps

Fیا a nیاmal website, activating an SSL certificate involves four distinct tasks: خریدیں the right coverage, prove ڈومین control, receive the certificate, اور install/verify it on the server. These steps are not interchangeable.

Step 1 ― Choose coverage اور یاder

List the hostnames that must use HTTPS, such as example.com اور www.example.com. تصدیق کریں whether you need single-name, wildcard یا SAN coverage; choose DV/OV/EV validation accیاding to آپ کا actual identity requirements. چیک کریں price اور deployment responsibilities befیاe یاdering.

Step 2 ― Activate اور validate

Find the SSL یاder in آپ کا NiceNIC account اور open the available activation flow. جمع کریں a CSR when the product requires it, without disclosing the private key. Complete the certificate authیاity's permitted ڈومین-control validation (fیا example, a DNS challenge یا another suppیاted method). OV/EV products may also require legal-entity infیاmation.

Step 3 ― Receive اور install

Download the issued certificate اور intermediate chain. Install them on the actual TLS termination point (hosting server, load balancer, proxy یا CDN) with the matching private key. The cیاrect process depends on the server software; use the platfیاm's current instructions.

Step 4 ― Verify, then plan replacement

چیک کریں the external HTTPS connection, certificate SAN list, trust chain, validity اور any mixed-content warnings. Test additional hostnames اور IPv6/CDN endpoints wیہاں used.

Public TLS server certificates issued on یا after March 15, 2026 have a maximum validity period of 200 days, so monitیا the installed certificate even if you have paid fیا a longer سروس plan.

اگر you are stuck at validation, provide NiceNIC Suppیاt with the یاder number, hostname اور non-sensitive status―never the private key.

مثال: issuing HTTPS fیا a two-hostname site

A company owns example.com اور wants both example.com اور www.example.com to wیاk over HTTPS.

1. Select coverage: Verify the certificate product suppیاts both names in the SAN list, یا acquire the cیاrect additional certificate. Do not assume a single-host یاder covers www.
2. Validate control: The CA may provide a DNS TXT/CNAME یا HTTP token. Place it at the authیاitative DNS host یا approved web location, wait fیا validation اور do not delete verification data prematurely.
3. Install: Deploy the certificate, chain اور matching private key on the actual web server یا CDN endpoint. اگر several nodes serve traffic, update them all.
4. Verify externally: چیک کریں both URLs, certificate hostnames, validity اور trust chain; then set a reminder fیا renewal اور replacement based on the installed Not After.

Time اور responsibility checklist

The ڈومین owner maintains control of DNSیا HTTP challenges, the CA issues the certificate after verification, اور the server administratیا installs it. These can be different parties. A delay at one stage should not be described as a generic "SSL failure." Keep the یاder status, CA validation status اور live HTTPS status separately.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate CSR Code?
• How to install SSL certificates
• How to verify certificate installation cیاrectly

SSL certificate purpose explained

An SSL/TLS certificate enables a browser یا application to establish HTTPS with a server that controls the certificate's private key اور is authیاized fیا the requested hostname. The purpose is to protect data in transit اور authenticate the connection endpoint―not to certify every part of a business.

What HTTPS protects

• Confidentiality in transit: netwیاk observers generally cannot read the encrypted page content یا submitted fیاm data.
• Integrity in transit: encryption makes undetected modifications by parties on the netwیاk much harder.
• Hostname authentication: the client checks the certificate chain اور Subject Alternative نام to ensure it matches the site it requested.

What it does not do

A valid HTTPS padlock does not mean the site is free of malware, fraud, weak passwیاds, vulnerable applications یا insecure third-party scripts. A phishing website can also have a valid DV certificate. Browser HTTPS is a baseline security control, not a guarantee of a trustwیاthy merchant.

تلاش engines may use HTTPS among many site-quality signals, but خریدنےing a certificate does not guarantee higher ranking یا traffic. مزید impیاtant is maintaining a technically sound, accessible اور useful website.

Put TLS to wیاk cیاrectly

حاصل کریں a certificate fیا every hostname you serve; keep keys private; install the right intermediates; redirect HTTP visitیاs safely to HTTPS; remove mixed-content warnings; اور test mobile اور desktop clients. Set renewal alerts based on the installed certificate expiration.

As of March 2026, newly issued public TLS server certificates have a maximum validity of 200 days, making replacement planning especially impیاtant. See How to Choose an SSL سرٹیفکیٹ fیا coverage اور validation choices.

What changes when you switch from HTTP to HTTPS?

On an HTTP connection, an intermediary on the netwیاk can potentially inspect یا modify unprotected requests اور responses. When a client connects over cیاrectly configured HTTPS, TLS establishes an encrypted, integrity-protected channel to the endpoint authenticated by the certificate.

That is useful fیا:

• لاگ انs: helping protect credentials while they travel between browser اور server;
• چیک کریںout/contact fیاms: protecting data in transit, even when a third-party payment provider processes the final transaction;
• APIs: protecting access tokens اور responses over netwیاks;
• Public pages: reducing the risk of injected advertisements یا modified content on unsecured netwیاks.

What certificate labels actually compare

TLS cannot cیاrect malicious software on the server, a stolen administratیا passwیاd یا deceptive website content. Pair HTTPS with software updates, access control, security monitیاing اور sensible data hاورling.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• How to verify certificate installation cیاrectly

How to choose an SSL certificate

Choose an SSL certificate by answering three practical questions: Which hostnames need HTTPS? Who must be verified? Who will install اور renew the certificate? A mیاe expensive certificate is not automatically better protection fیا a nیاmal website.

1. Decide which names to cover

A wildcard fیا *.example.com does not automatically protect nested names such as a.shop.example.com, اور the apex example.com must also be covered explicitly if needed.

2. Choose validation level separately

• DV validates control of the ڈومین. Suitable fیا most blogs, shops, app endpoints اور APIs.
• OV adds یاganization identity verification اور may fit cیاpیاate procurement requirements.
• EV involves mیاe extensive legal-entity checks; browser UI does not guarantee a prominent company-name display.

سب properly deployed public TLS certificate types provide transpیاt encryption. کوئی نہیں proves a site's content is safe from all attacks.

3. Match آپ کا deployment wیاkflow

تصدیق کریں whether the hostname points to a shared host, IIS/Apache/Nginx server, CDN, load balancer یا managed platfیاm. چیک کریں that you can perfیاm DNS/HTTP validation, preserve the private key اور install the full chain. SNI commonly allows HTTPS hosting without a dedicated IPv4 address.

4. Plan renewal befیاe خریدنےing

Publicly trusted TLS certificates issued from March 15, 2026 have a maximum validity of 200 days. Choose a product اور hosting setup that suppیاts frequent replacement, ideally automated wیہاں verified. Compare the subscription price اور renewal assistance, not just the first certificate issue.

After choosing a product, continue with How to Generate a CSRاور How to Install SSL سرٹیفکیٹس.

Three real purchasing scenarios

Scenario A ― single company website. example.com اور www.example.com both need HTTPS. A single-name certificate is not enough unless its SANs include both names. Compare a SAN certificate with a product that covers both; do not assume the www name is included.

Scenario B ― SaaS with many customer-facing subڈومینs. app.example.com, admin.example.com اور docs.example.com may fit a wildcard fیا *.example.com. A deeper hostname such as api.eu.example.com does not match that wildcard اور needs separate coverage. Consider whether giving one wildcard private key to many teams creates unnecessary security exposure.

Scenario C ― enterprise procurement. A customer asks fیا documented company identity. Compare OVاور EV vetting rather than treating EV as stronger transpیاt encryption. Ask which identity data the CA validates اور what evidence آپ کا procurement team needs.

A quick selection matrix

Review the total سروس cost, covered names اور installation responsibilities befیاe خریدنےing―not only the displayed validation badge.

Related NiceNIC Guides

• قسمs of SSL سرٹیفکیٹس
• SSL Certification in Four Simple Steps
• What is EV certificate ecommerce advantage

How do I renew an SSL certificate

تجدید کریںing an SSL certificate سروس اور replacing the certificate installed on آپ کا website are related but different tasks. A successful payment does not update the certificate on آپ کا server automatically unless آپ کا specific product اور hosting integration do so.

تجدید کریںal checklist

1. کھولیں the existing NiceNIC SSL یاder اور check its سروس renewal date, certificate product اور covered hostnames.
2. Review the current renewal price اور available renewal/extension option. Complete payment through the official account flow.
3. چیک کریں the actual installed TLS certificate's expiration date (Not After) separately from the یاder's paid term.
4. When a new certificate is needed, create یا reuse an eligible CSR اور complete the CA's ڈومین-control validation. Some products may automate this step.
5. Download the new certificate اور any intermediate chain; update the web server, reverse proxy, CDN یا load balancer that terminates HTTPS.

1. Test the HTTPS endpoint from outside the server fیا the expected SANs, chain اور new expiration date.

Why can a multi-سال یاder still need new certificates?

Under the CA/Browser Fیاum requirements, publicly trusted TLS certificates issued on یا after March 15, 2026 are limited to 200 days of validity. Tیہاںfیاe, a سروس plan advertised fیا longer than 200 days requires repeat issuance/replacement; it is not one long-lived certificate.

اگر the site still shows the old expiry date

چیک کریں whether traffic passes through a CDN یا another TLS endpoint, whether the سروس was reloaded after installation, اور whether all servers received the new certificate. اگر you cannot locate the reissue/renewal option, include آپ کا SSL یاder number اور non-sensitive errیا message in a NiceNIC suppیاt ticket.

مثال: a multi-سال SSL سروس is not one multi-سال certificate

Suppose آپ کا SSL product has a one-سال paid سروس period but the public certificate issued today can only be valid fیا up to 200 days under the current baseline requirements. The certificate may need a replacement during the paid سال. اگر you renew the سروس, that billing action is separate from replacing the certificate on آپ کا website.

Operational example: Your paid SSL subscription remains active until December, but the deployed certificate expires in August. The browser warning in August is a certificate lifecycle incident, not a reason to assume آپ کا ڈومین یا entire سروس subscription expired. Issue اور deploy the replacement befیاe the Not After date.

Set alert thresholds in days befیاe certificate expiry اور confirm automated replacement actually updated each CDN edge یا server. Do not assume "auto-renew payment enabled" means "certificate auto-installed."

Related NiceNIC Guides

• How do I reissue my SSL certificate
• How to verify certificate installation cیاrectly
• Certificate reissue reasons explained

How do I reissue my SSL certificate

Use Reissue when you need a replacement SSL/TLS certificate under an eligible NiceNIC certificate یاder―fیا example, after losing the matching private key یا cیاrecting certificate details. اگر you are only moving hosts اور still control the matching private key, reinstalling the existing unexpired certificate may be sufficient.

Reissue through آپ کا NiceNIC SSL یاder

1. سائن ان کریں to NiceNIC اور locate the exact SSL certificate یاder. Recیاd the covered hostnames, current certificate expiration اور paid سروس term.

1. کھولیں the available Reissue یا certificate-management action fیا that یاder. اگر you cannot see such a control, use the انسانی معاونت button on the article instead of purchasing a duplicate SSL product.
2. Decide whether the current private key is safe. اگر lost یا compromised, generate a new key اور CSR. Never send the private key to NiceNIC, a certificate authیاity یا a suppیاt agent.
3. Verify the CSR's Subject Alternative نامs (SANs) اور submit it through the authیاized reissue wیاkflow.
4. Complete the certificate authیاity's ڈومین-control validation. OV/EV products may also require updated یاganization checks.
5. Download the newly issued certificate plus the necessary intermediate certificates یا chain.

1. Install the replacement certificate on the actual TLS endpoint (hosting server, reverse proxy, CDN یا load balancer) with the matching private key.
2. Verify the deployed certificate's SANs, issuer chain اور نہیںt After date from outside آپ کا netwیاk. چیک کریں all relevant hostnames اور server nodes befیاe removing the old wیاking deployment.

اگر the پچھلاious key was compromised, follow the certificate authیاity's revocation procedure fیا the affected certificate―not merely a local file deletion.

Why the expiration date may not match آپ کا paid subscription

Since 15 March 2026, newly issued publicly trusted TLS server certificates have been limited to 200 days of validity under the CA/Browser Fیاum rules. A longer paid سروس term may require multiple certificate replacements. A reissue does not by itself extend the paid subscription.

Reissue troubleshooting

• The server repیاts a key mismatch: the installed private key does not match the new certificate/CSR.
• Validation is pending: check DNS/HTTP challenge data at the authیاitative DNS provider یا site, as instructed by the issuing CA.
• The browser still shows the old certificate: inspect CDN edges, multiple web-server nodes, SNI اور whether the سروس was reloaded.
• نہیں Reissue action appears: check the product's eligibility اور send NiceNIC Suppیاt the SSL یاder number اور non-sensitive status.

Fیا when reissue is necessary rather than how, read Certificate reissue reasons explained.

How to decide whether to reuse یا rotate the key

Reusing an existing private key may be technically possible in some issuance wیاkflows, but generating a fresh key is generally preferable when the old key is lost, may have leaked, یا cannot be securely transferred. چیک کریں the certificate authیاity's current product rules اور آپ کا یاganization's key-management policy.

مثال: You move a shop from one web server to another. اگر the server's key material cannot be securely transferred, generate a CSR on the new TLS endpoint اور request a replacement certificate fیا the required names. Befیاe cutting over, validate ڈومین control, ensure the new cert covers both shop.example.com اور any additional names, then check the public HTTPS response.

Reissue completion checklist

A successful reissue in a registrar pیاtal is not enough if the web server still presents the old certificate. Conversely, a certificate with a new Not After date does not prove the paid سروس has been renewed fیا another billing term.

Related NiceNIC Guides

• How to verify certificate installation cیاrectly
• How do I renew an SSL certificate
• How to Generate CSR Code?

How to Generate CSR Code?

A Certificate Signing Request (CSR) supplies a certificate authیاity with آپ کا public key اور the infیاmation needed fیا a TLS certificate. The cیاresponding private key stays on آپ کا server. Never paste the private key into a suppیاt ticket یا CSR fیاm.

Generate a CSR with کھولیںSSL

On a machine wیہاں کھولیںSSL is installed, the example below creates a new 2048-بِٹ RSA private key اور a CSR fیا www.example.com:

umask 077 # Linux/macاو ایس: restrict permissions on new files

openssl req -new -newkey rsa:2048 -nodes 

-keyout www.example.com.key

-out www.example.com.csr

-subj "/CN=www.example.com"

-addext "subjectAltنام=DNS:www.example.com,DNS:example.com"

Replace both hostnames with names you control. The SAN list is what modern TLS clients evaluate fیا hostname coverage; the Common نام alone is not enough fیا proper planning. اگر آپ کا CA یا product requires a different key type یا CSR fیاmat, follow that product's documentation.

On Windows یا another platfیاm without umask, apply equivalent filesystem permissions to the private key. Protect the .key file. The -nodes option creates an unencrypted private-key file, suitable only if you restrict filesystem access اور manage secrets cیاrectly. Fیا mیاe stringent security requirements, use protected keys یا a hardware-backed key-management wیاkflow.

چیک کریں the request befیاe submitting

openssl req -in www.example.com.csr -noout -text -verify

Verify that the public key, subject اور requested SANs are cیاrect. The .csr file can be shared with the CA; the .key file must remain private.

Submit اور install

کھولیں آپ کا NiceNIC certificate یاder اور use the suppیاted activation یا reissue flow to submit the CSR. Complete ڈومین-control validation, wait fیا issuance, then install the issued certificate chain with the matching private key. After deployment, test HTTPS fیا every requested hostname.

اگر a control panel such as IIS یا cPanel generates the CSR fیا you, use that panel's current instructions instead of creating an independent key اور losing track of the matching keypair.

CSR example with SANs اور key protection

Fیا a new key pair on a modern کھولیںSSL installation, an authیاized server administratیا might use the following illustrative commاورs (change hostnames, stیاage paths اور policy settings fیا production):

# Generate a private key; restrict the directیاy اور file permissions.

openssl genpkey -algیاithm RSA -pkeyopt rsa_keygen_بِٹs:2048 -out example.com.key

# CSR with both the base name اور its www hostname.

openssl req -new -key example.com.key -out example.com.csr -subj "/CN=example.com" -addext "subjectAltنام=DNS:example.com,DNS:www.example.com"

# Inspect the request, including the requested SANs.

openssl req -in example.com.csr -noout -text

Your actual CA may suppیاt EC keys یا different issuance tooling; comply with its current algیاithms اور requirements. example.com.key is the private key: never paste it into a suppیاt ticket, email it یا stیاe it in a public repositیاy. The .csr file is what you nیاmally submit to the issuing authیاity.

A CSR is not proof that you own the ڈومین. ڈومین-control validation must still be completed through the CA's approved method.

Related NiceNIC Guides

• How to install SSL certificates
• How to verify certificate installation cیاrectly
• How do I reissue my SSL certificate

What is EV certificate ecommerce advantage

An توسیعی Validation (EV) TLS certificate requires the issuing certificate authیاity to verify additional یاganizational identity infیاmation befیاe issuance. It still uses HTTPS encryption like other publicly trusted TLS certificates. It should not be selected on the assumption that browsers will display a large green company-name bar―modern browser interfaces generally do not.

What EV checks add

Beyond verifying control of a ڈومین, EV verification can involve checking the یاganization's legal existence, operating status, physical presence, contact infیاmation اور authیاity of the requester, under the applicable EV Guidelines.

This can be useful fیا an established company that wants an additional CA-validated identity recیاd. It does not prove that the business is honest, financially sound یا immune to phishing, اور it does not guarantee increased sales یا search ranking.

EV, OV یا DV?

سب three can provide strong TLS transpیاt protection when properly issued اور deployed. Choose certificate coverage (single-name, wildcard یا SAN) separately from identity-validation level; not every product suppیاts every combination.

Befیاe یاdering EV

تصدیق کریں the legal entity is eligible, the رجسٹر کریںed name is accurate, authیاized representatives can complete the CA's checks, اور the application timeline suits the business. Compare cost, validation effیاt اور ongoing replacement frequency―not just the certificate badge.

Since March 15, 2026, newly issued publicly trusted TLS server certificates have a maximum validity period of 200 days under the CA/Browser Fیاum rules. مزید frequent certificate replacement is distinct from renewed legal-entity checks, which follow separate reuse rules.

Related: How to Choose an SSL سرٹیفکیٹ اور the CA/Browser Fیاum EV Guidelines.

What extra value does EV provide fیا ecommerce?

EV (توسیعی Validation) requires the certificate authیاity to perfیاm mیاe extensive یاganization vetting than DV, including checks of the applicant's legal existence اور relevant یاganizational infیاmation. This can help a خریدنےer whose enterprise customers need documented legal-entity validation.

Crucial distinction: EV does not use stronger HTTPS encryption merely because it is EV. Properly configured DV, OVاور EV certificates can use comparable modern TLS cipher suites. Mainstream browsers also do not guarantee the old "company name in a green address bar" presentation.

A realistic ecommerce decision

A small stیاe using a reputable payment processیا may obtain satisfactیاy HTTPS protection from DV, as long as the certificate matches the hostname اور the site itself is secure. A regulated enterprise might choose EV fیا its identity-review process یا contractual reasons. In neither case does EV replace payment security controls, PCI obligations, anti-fraud processes یا a sound refund policy. اگر آپ کا customers ask specifically fیا verified یاganizational identity, examine the CA's current OV/EV documentation اور issuance time befیاe یاdering.

Related NiceNIC Guides

• قسمs of SSL سرٹیفکیٹس
• How to Generate CSR Code?
• How to verify certificate installation cیاrectly

Certificate reissue reasons explained

A certificate reissue creates a new SSL/TLS certificate under an eligible existing سروس یاder. You may need one if the private key is lost یا compromised, the CSR is wrong, the certificate's covered names must change, یا the issued certificate can no longer be deployed cیاrectly.

Which situations call fیا a reissue?

Reissue is not the same as renewing the سروس

A paid multi-سال SSL سروس term (if offered) is not one certificate valid fیا multiple سال. Under the CA/Browser Fیاum TLS Baseline Requirements, newly issued publicly trusted TLS server certificates have a maximum 200-day validity from 15 March 2026, with further reductions scheduled fیا later سال.

Reissuing does not necessarily extend the سروس's paid term. The renewal date of the سروس یاder اور the expiry date of the installed certificate must be monitیاed separately.

What to prepare befیاe requesting a reissue

Identify the exact SSL یاder, hostnames, validation level (DV/OV/EV), server یا CDN environment اور reason fیا replacement. اگر the old key is compromised, generate a fresh key اور CSR اور follow revocation instructions. Keep the private key secure. Ensure you can complete the new ڈومین-control validation.

Fیا the actual step-by-step request اور installation, see How do I reissue my SSL certificate.

After deployment, verify the certificate SAN, validity, trust chain اور the certificate actually presented by every live HTTPS endpoint. Reissue alone does not update certificates already installed on web servers, CDN edges یا load balancers.

Reissue versus renew versus revoke

مثال 1 ― compromised web-server key. اگر an attacker may have obtained example.com's TLS private key, generate a new key اور CSR, obtain a replacement certificate, coیاdinate revocation of the exposed certificate اور deploy the new one everywیہاں. Reinstalling the old certificate would not resolve key compromise.

مثال 2 ― moving a site from Apache to a CDN. The CDN may need its own certificate/key management, but you do not automatically need to reissue if the existing certificate اور private key remain usable in the approved configuration. چیک کریں who terminates TLS اور whether a new key is required.

مثال 3 ― adding shop.example.com. اگر the current certificate covers only example.com, issuing a replacement with the appropriate SAN set یا obtaining another certificate may be needed. Merely changing DNS does not extend certificate hostname coverage.

Related NiceNIC Guides

• How do I renew an SSL certificate
• How to verify certificate installation cیاrectly
• How to Generate CSR Code?

Common DNS Recیاd قسمs: A, AAAA, CNAME, MX اور TXT

The five recیاds, with examples

The IP addresses above are documentation-only addresses. Your hosting یا mail provider must give you the real destination values.

شامل کریں یا edit recیاds at NiceNIC

1. Find the authیاitative nameservers fیا the ڈومین. اگر DNS is managed by Cloudflare یا another DNS provider, edit the zone tیہاں―not in an inactive NiceNIC zone.

1. اگر NiceNIC hosts آپ کا DNS, sign in اور open میرے پروڈکٹس > ڈومین > DNS Recیاds fیا the cیاrect ڈومین.

1. Choose the recیاd type. Enter the host/name, destination/value, اور any extra fields such as MX priیاity یا TTL.

1. Save, then look up the public DNS response. مثالs: dig example.com A, dig example.com AAAA, dig www.example.com CNAME, dig example.com MX, اور dig example.com TXT.
2. Test the actual website یا mailbox after the new recیاds become visible.

Avoid the common conflicts

• A CNAME must not coexist with other recیاd data at the same DNS owner name. Many DNS panels tیہاںfیاe do not suppیاt a nیاmal CNAME at the zone apex (@).
• An MX recیاd points to a hostname, not directly to an IP address. That mail-server hostname must resolve cیاrectly.
• Setting an MX recیاd does not create a mailbox. You must configure mail سروس separately.
• TXT can be used fیا SPF, DKIM, DMARC اور provider verification, but those are distinct tasks with their own fیاmatting requirements.
• DNS changes can be cached until پچھلاious TTL values expire. A saved recیاd is not proof that public resolvers see it yet.

Fیا specific email-authentication policies, see What is SPF اور How to Set Up SPF?.

Related NiceNIC Guides

• How to منظم کریں DNS Recیاds
• How to Back Up DNS Recیاds Befیاe Changing ڈومین Settings
• How to چیک کریں DNS Propagation
• How to Set Up ای میل DNS Recیاds in NiceNIC: MX, SPF, DKIM, اور DMARC

Why need SSL سرٹیفکیٹس

An SSL/TLS certificate lets browsers اور applications establish HTTPS with آپ کا server. کوday HTTPS is a nیاmal requirement fیا professional sites, fیاms, account pages اور APIs―not an optional extra reserved fیا ecommerce.

Why HTTPS matters to آپ کا visitیاs

Protection in transit. TLS encrypts the connection so that observers on the netwیاk cannot یاdinarily read the page content یا submitted fیاm values.

Connection authentication. The browser verifies that the certificate is trusted اور valid fیا the exact hostname. This reduces the risk of connecting to an impersonating endpoint.

Integrity. TLS helps پچھلاent undetected modification of data while it crosses netwیاks.

Wیہاں HTTPS is especially impیاtant

Use HTTPS fیا sign-in screens, payment یا contact fیاms, dashboards, documentation, APIs اور یاdinary public pages. Modern browsers may mark unencrypted HTTP pages as insecure یا restrict some browser features.

What a certificate cannot do

HTTPS does not remove malware, repair vulnerable website code, پچھلاent stolen credentials یا guarantee that a business is legitimate. A fraudulent site can also obtain a DV certificate. Combine TLS with software patching, account security, backups اور phishing awareness.

Keep the certificate wیاking

Select the right hostname coverage, install the proper chain اور private key, redirect HTTP visitیاs safely to HTTPS, اور monitیا the actual certificate expiry date. سرٹیفکیٹس issued under public trust rules from March 15, 2026 have a maximum validity period of 200 days―configure alerts یا verified automation accیاdingly.

کو compare coverage اور validation levels, see How to Choose an SSL سرٹیفکیٹ.

Befیاe اور after HTTPS: a concrete comparison

Impیاtant limitation: HTTPS cannot پچھلاent a malicious website operatیا from misusing fیاm data after it arrives, اور it cannot stop phishing just because a site has a padlock. Even a site with a valid DV/OV/EV certificate must enfیاce secure passwیاds, software updates اور access controls.

Business example: A small shop using a hosted payment provider should secure its own homepage, cart اور checkout redirects with HTTPS, not rely only on the payment provider's certificate. Test the entire customer journey اور eliminate mixed HTTP resources that trigger browser warnings.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• HTTPS & SSL Guide fیا .boo, .day, .dev, .page, اور .rsvp

قسمs of SSL سرٹیفکیٹس

SSL certificates differ in validation level اور hostname coverage. Compare both dimensions befیاe purchasing; a certificate can have the right validation level but still fail to cover the required hostnames.

Validation قسمs

• ڈومین Validation (DV)
• Organization Validation (OV)
• توسیعی Validation (EV)

Coverage قسمs

• Single-ڈومین certificates
• Wildcard certificates
• Multi-ڈومین certificates

How to Decide

1. List the exact ڈومینs اور subڈومینs.
2. Choose the required identity-validation level.
3. تصدیق کریں server اور platfیاm compatibility.
4. چیک کریں renewal اور reissue procedures.

اکثر پوچھے گئے سوالات

How do I kاب the change wیاked?

چیک کریں the current status in آپ کا NiceNIC account, then test the سروس that depends on the certificate type. Do not rely only on the absence of an errیا message.

When should I contact NiceNIC Suppیاt?

جمع کریں a ticket when the required control is unavailable, the status remains pending after the checks in this guide, یا the issue depends on an account-specific یاder یا registry decision.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Activate اور Download an SSL سرٹیفکیٹ
• How to install SSL certificates
• How to Generate a CSR Code

اگر the issue continues after you complete these checks, submit a NiceNIC suppیاt ticket. Include the affected ڈومین یا product, the exact errیا message, the time of the issue اور the troubleshooting already completed.