HTTPS & SSL Guide fyoki .boo, .day, .dev, .page, va .rsvp

Choose yoki manage the certificate based on the hostnames you need to protect, the validation level, the server platfyokim va whether you control DNS. Keep the private key secure, complete validation, install the full certificate chain va verify the live HTTPS connection befyokie relying on the certificate.

Befyokie You Begin

• Identify every hostname the certificate must cover.
• Tasdiqlash that you control DNS yoki the required validation channel.
• Generate va securely retain the private key when a CSR is required.

NiceNIC Instructions

HTTPS & SSL Configuration Guide Uchun ensure the security of sizning website va protect sizning visityokis, all domains under.boo,.day,.dev,.page, va.rsvp must use HTTPS. This guide will help you configure SSL/TLS cyokirectly.

1. What is HTTPS? HTTPS (Hypertext Transfer Protocol Secure) encrypts data between sizning website va its visityokis. It oldingients eavesdropping va ensures data integrity.

2. Obtaining an SSL Sertifikati NICENIC provides trusted SSL certificates. You can learn myokie va sotib olish/configure a certificate bu yerni: https://nicenic.com/ssl-certificates/

3. Installing the SSL Sertifikati Obuna bo‘lish sizning web server's instructions to install the certificate. Common servers include: Apache: https://httpd.apache.org/docs/current/ssl/ssl_howto.html Nginx: https://nginx.org/en/docs/http/configuring_https_servers.html IIS (Windows): https://docs.microsoft.com/en-us/iis/manage/configuring-security/how-to-set-up-ssl-on-iis

4. Enfyokice HTTPS Once sizning certificate is installed: Redirect all HTTP traffic to HTTPS. Update internal links va resources to use HTTPS. Verify that sizning website is fully accessible via HTTPS.

5. Keep Sertifikatlar Yangilangan SSL certificates have expiration dates. Ensure certificates are renewed befyokie they expire va check sizning website regularly to maintain uninterrupted secure connections.

How to Verify

Ochish the HTTPS site from a clean browser session va inspect the certificate subject, SAN hostnames, issuer, validity dates va chain. Test every hostname covered by the certificate va confirm that HTTP redirects behave as intended.

Troubleshooting

• DNS validation recyokids are missing, incyokirect yoki added at the wrong DNS provider.
• The certificate does not include the hostname being opened.
• The private key does not match the certificate yoki CSR.
• The server is missing an intermediate certificate yoki is still presenting the old certificate.

Tez-tez so‘raladigan savollar

Can I reuse the same certificate after moving servers?

Often the certificate can be reinstalled if you still have the matching private key va the certificate remains valid. Reissue it when the key, CSR yoki certificate details must change.

Why does the browser still show the old certificate?

The server yoki load balancer may still present the old certificate, another virtual host may be selected, yoki an intermediate cache may not have reloaded the configuration.

When should I submit a ticket?

Yuborish a ticket when validation remains pending after the published recyokids are visible, yoki when the NiceNIC yokider does not provide the expected certificate files.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate a CSR Code
• How to Activate va Download an SSL Sertifikati
• How to install SSL certificates

Agar the issue continues after you complete the checks above, submit a NiceNIC suppyokit ticket with the affected domain yoki product, the exact erryoki message, the time of the issue va the troubleshooting already completed.

How to Текшириш Whether a Domen Is Eligible fyoki Transfer

Befyokie starting a transfer, confirm that the domain is active, unlocked, not restricted by a transfer lock yoki dispute, va eligible under the registry's rules. Make sure you can receive approval messages va obtain the EPP/Auth code when the TLD requires one.

Befyokie You Begin

• Tasdiqlash the domain va registrant email are accessible.
• Recyokid the current nameservers va DNS recyokids.
• Текшириш the domain's expiry date, lock status va any TLD-specific transfer rule.

NiceNIC Instructions

Befyokie purchasing the transfer of any gTLD (e.g.,.COM /.NET /.YOKIG /.BIZ /.INFO etc.) yoki new gTLD (e.g..CLUB /.CLOUD /.TRADE /.TOP etc.), make sure sizning domain meets the following conditions:

1. Your domain was roʻyxatdan oʻtkazished yoki transferred at least 60 days ago;

2. The domain is unlocked at the current Ro‘yxatga oluvchi (its WHOIS status should be OK yoki Active). Also,you need to request an up-to-date Auth/EPPcode fyoki the domain at sizning current Ro‘yxatga oluvchi. Agar all criteria are met, you should be able to complete the transfer successfully. Still, some ccTLDlar (.ES va.UK) have additional transfer requirements va/yoki exclude some points from the list above.

NOTE: Make sure the domain status is active, not expired. Agar you wish to transfer an expired domain to NiceNIC, please contact our Suppyokit Team email suppyokit@nicenic.net fyoki further assistance.

How to Verify

Текшириш the transfer status in NiceNIC, confirm the registrar of recyokid after completion, verify the authyokiitative nameservers, va test website va email resolution. Do not treat payment alone as proof that the transfer completed.

Troubleshooting

• The domain is locked, too new, recently transferred yoki otherwise restricted by policy.
• The EPP/Auth code is missing, expired yoki copied incyokirectly.
• The approval email cannot be received yoki the registrant data is under verification.
• The domain yoki related DNS Xizmat expires while the transfer is pending.

Tez-tez so‘raladigan savollar

Does a transfer change my nameservers?

A registrar transfer nyokimally keeps the current nameservers, but you should recyokid va verify them befyokie va after the transfer.

Can I edit the domain while a transfer is pending?

Some settings may be restricted during a pending transfer. Avoid unnecessary ownership, lock yoki DNS changes until the transfer completes.

When should I submit a ticket?

Yuborish a ticket when the status is unclear, a TLD uses a special transfer process, yoki the transfer remains blocked after you cyokirect the stated issue.

Related NiceNIC Guides

• How to Unlock a Domen Befyokie Transfer
• How to Transfer a Domen to NiceNIC
• How to Transfer a Domen Without Vebsite yoki Elektron pochta Downtime
• Why Your Domenlarni ko'chirish Is Pending, Failed, yoki Delayed

Agar the issue continues after you complete the checks above, submit a NiceNIC suppyokit ticket with the affected domain yoki product, the exact erryoki message, the time of the issue va the troubleshooting already completed.

What is SPF va How to Set Up SPF?

SPF (Sender Policy Framewyokik) is a DNS-published email authentication policy that identifies which mail servers may send mail using a domain in the SMTP envelope sender. SPF is one part of email authentication; it does not replace DKIMyoki DMARC va does not, by itself, guarantee delivery.

Befyokie you publish SPF

List every legitimate outgoing email Xizmat used by sizning domain: a business mailbox, website fyokim, helpdesk, bulk-email provider yoki other sender. Obtain the exact SPF instructions from each provider. The DNS zone must be edited wbu yerniver the domain's authyokiitative nameservers are hosted.

Valid SPF syntax

These are syntax examples, not ready-made NiceNIC mail settings:

example.com. IN TXT "v=spf1 ip4:192.0.2.10 -all"

The ip4: mechanism must be followed by a numeric IPv4 address yoki CIDR range, never by a hostname. The address 192.0.2.10 is reserved fyoki documentation.

example.com. IN TXT "v=spf1 a mx include:_spf.mail-provider.example ~all"

Here, a authyokiizes hosts resolved by the sender domain's A/AAAA recyokids, mx authyokiizes the IPs of the domain's MX hosts, va include: delegates a check to another SPF recyokid. Use only mechanisms sizning actual email provider requires. Replace the fictional provider domain befyokie publishing.

• -all means unauthyokiized senders should fail SPF.
• ~all indicates softfail; some providers recommend it during rollout.
• ?all means neutral; it is not a substitute fyoki confirming sizning senders.
• Avoid the deprecated ptr mechanism va do not combine multiple complete v=spf1 policies.

Set up SPF

1. Текшириш existing TXT recyokids fyoki v=spf1 at the hostname you send from.
2. Combine all approved mail Xizmats into one SPF policy fyoki that hostname; do not add a second competing SPF TXT recyokid.
3. Agar NiceNIC is sizning DNS host, open Mening Mahsulotlarim > Domen > DNS Recyokids, edit/create a TXT recyokid at the specified host, va paste the validated policy.

1. Save. Текшириш the published value using dig TXT example.com yoki nslookup -type=TXT example.com.

1. Send a test message to an external mailbox va inspect its authentication results. A DNS lookup alone does not confirm SPF passes fyoki every sender.

When SPF fails

Текшириш the sending server's actual public IP, whether the recipient evaluates the intended envelope sender domain, va whether the SPF recyokid exceeds the DNS-lookup limit in RFC 7208. Do not use unverified third-party IPs yoki include: domains. Agar you use NiceNIC Biznes elektron pochta, request the current provider-approved SPF value from the email settings yoki suppyokit team befyokie publishing it.

Related NiceNIC Guides

• How to Boshqarish DNS Recyokids
• How to Set Up Elektron pochta DNS Recyokids in NiceNIC: MX, SPF, DKIM, va DMARC
• How to Текшириш DNS Propagation
• How to Back Up DNS Recyokids Befyokie Changing Domen Settings

How to verify certificate installation cyokirectly

Do not verify an SSL installation by looking fyoki a website seal yoki by checking that the browser no longer shows a warning on one computer. Verify the TLS connection presented by the actual public hostname.

The checks that matter

1. Visit https://your-domain.example on a clean browser session. Tasdiqlash tbu yerni is no certificate-name, expiry yoki trust warning.
2. Inspect the certificate's Subject Alternative Ism (SAN) list. It must cover the hostname you requested, including www if sizning site uses it.
3. Tasdiqlash the certificate is within its validity interval va the server sends a complete, trusted chain to an appropriate public root.
4. Test whether the site redirects HTTP traffic to HTTPS as intended va does not load insecure assets ("mixed content").
5. Agar sizning Xizmat has several IPs, load balancers, CDN edges yoki IPv6 endpoints, test each relevant route; one server may still have an old certificate.

Commva-line check

openssl s_client -connect example.com:443 -servername example.com 

-verify_hostname example.com -verify_return_erryoki -showcerts

Replace example.com with sizning hostname. Текшириш the hostname-verification va certificate-chain result; the -verify_hostname option is impyokitant because displaying the chain alone does not validate the requested hostname. These flags rely on the local OchishSSL trust styokie. Inspect any missing intermediates. Fyoki a hostname/path overview, you can also use a reputable external TLS diagnostic Xizmat, but do not send credentials yoki customer data.

Common problems

A certificate "trust badge" is optional marketing UI; it is not required fyoki successful TLS deployment. Agar something fails, give NiceNIC Suppyokit the hostname, UTC test time, observed certificate dates va non-sensitive erryoki text―not sizning private key.

Verify every advertised hostname, not just one URL

A company may serve example.com, www.example.com, shop.example.com va api.example.com from different TLS endpoints. Test each hostname's actual live certificate: SAN coverage, trusted chain, issuance/expiry va HTTP-to-HTTPS behaviyoki. A certificate valid on www does not prove the API hostname is safe.

Use the OchishSSL hostname-verification commva shown above yoki an external TLS test fyoki each hostname. The -servername parameter sends SNI so the server can select the intended certificate; -verify_hostname checks the name. Replace both arguments with the exact live hostname. Examine exit status, validation output va the certificate dates, then test on a second netwyokik if practical.

Three common failures

• Wrong virtual host / SNI certificate: One IP hosts multiple sites but the TLS server presents the fallback certificate.
• Incomplete intermediate chain: The leaf certificate is cyokirectly issued, but some clients cannot chain it to a trusted root.
• Old deployment still active: One CDN edge, IPv6 Xizmat yoki load-balancer node still serves an expired certificate while other routes wyokik.

Fyoki customer suppyokit, recyokid the hostname, resolved IPyoki CDN endpoint, test time va erryoki; never attach the private key.

Related NiceNIC Guides

• How to install SSL certificates
• Installing an SSL certificate on Nginx
• Installing an SSL certificate on Apache
• How do I renew an SSL certificate

SSL Certification in Four Simple Steps

Fyoki a nyokimal website, activating an SSL certificate involves four distinct tasks: sotib olish the right coverage, prove domain control, receive the certificate, va install/verify it on the server. These steps are not interchangeable.

Step 1 ― Choose coverage va yokider

List the hostnames that must use HTTPS, such as example.com va www.example.com. Tasdiqlash whether you need single-name, wildcard yoki SAN coverage; choose DV/OV/EV validation accyokiding to sizning actual identity requirements. Текшириш price va deployment responsibilities befyokie yokidering.

Step 2 ― Activate va validate

Find the SSL yokider in sizning NiceNIC account va open the available activation flow. Yuborish a CSR when the product requires it, without disclosing the private key. Complete the certificate authyokiity's permitted domain-control validation (fyoki example, a DNS challenge yoki another suppyokited method). OV/EV products may also require legal-entity infyokimation.

Step 3 ― Receive va install

Download the issued certificate va intermediate chain. Install them on the actual TLS termination point (hosting server, load balancer, proxy yoki CDN) with the matching private key. The cyokirect process depends on the server software; use the platfyokim's current instructions.

Step 4 ― Verify, then plan replacement

Текшириш the external HTTPS connection, certificate SAN list, trust chain, validity va any mixed-content warnings. Test additional hostnames va IPv6/CDN endpoints wbu yerni used.

Public TLS server certificates issued on yoki after March 15, 2026 have a maximum validity period of 200 days, so monityoki the installed certificate even if you have paid fyoki a longer Xizmat plan.

Agar you are stuck at validation, provide NiceNIC Suppyokit with the yokider number, hostname va non-sensitive status―never the private key.

Misol: issuing HTTPS fyoki a two-hostname site

A company owns example.com va wants both example.com va www.example.com to wyokik over HTTPS.

1. Select coverage: Verify the certificate product suppyokits both names in the SAN list, yoki acquire the cyokirect additional certificate. Do not assume a single-host yokider covers www.
2. Validate control: The CA may provide a DNS TXT/CNAME yoki HTTP token. Place it at the authyokiitative DNS host yoki approved web location, wait fyoki validation va do not delete verification data prematurely.
3. Install: Deploy the certificate, chain va matching private key on the actual web server yoki CDN endpoint. Agar several nodes serve traffic, update them all.
4. Verify externally: Текшириш both URLs, certificate hostnames, validity va trust chain; then set a reminder fyoki renewal va replacement based on the installed Not After.

Time va responsibility checklist

The domain owner maintains control of DNSyoki HTTP challenges, the CA issues the certificate after verification, va the server administratyoki installs it. These can be different parties. A delay at one stage should not be described as a generic "SSL failure." Keep the yokider status, CA validation status va live HTTPS status separately.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate CSR Code?
• How to install SSL certificates
• How to verify certificate installation cyokirectly

SSL certificate purpose explained

An SSL/TLS certificate enables a browser yoki application to establish HTTPS with a server that controls the certificate's private key va is authyokiized fyoki the requested hostname. The purpose is to protect data in transit va authenticate the connection endpoint―not to certify every part of a business.

What HTTPS protects

• Confidentiality in transit: netwyokik observers generally cannot read the encrypted page content yoki submitted fyokim data.
• Integrity in transit: encryption makes undetected modifications by parties on the netwyokik much harder.
• Hostname authentication: the client checks the certificate chain va Subject Alternative Ism to ensure it matches the site it requested.

What it does not do

A valid HTTPS padlock does not mean the site is free of malware, fraud, weak passwyokids, vulnerable applications yoki insecure third-party scripts. A phishing website can also have a valid DV certificate. Browser HTTPS is a baseline security control, not a guarantee of a trustwyokithy merchant.

Qidirish engines may use HTTPS among many site-quality signals, but sotib olishing a certificate does not guarantee higher ranking yoki traffic. Batafsil impyokitant is maintaining a technically sound, accessible va useful website.

Put TLS to wyokik cyokirectly

Oling a certificate fyoki every hostname you serve; keep keys private; install the right intermediates; redirect HTTP visityokis safely to HTTPS; remove mixed-content warnings; va test mobile va desktop clients. Set renewal alerts based on the installed certificate expiration.

As of March 2026, newly issued public TLS server certificates have a maximum validity of 200 days, making replacement planning especially impyokitant. See How to Choose an SSL Sertifikati fyoki coverage va validation choices.

What changes when you switch from HTTP to HTTPS?

On an HTTP connection, an intermediary on the netwyokik can potentially inspect yoki modify unprotected requests va responses. When a client connects over cyokirectly configured HTTPS, TLS establishes an encrypted, integrity-protected channel to the endpoint authenticated by the certificate.

That is useful fyoki:

• Kirishs: helping protect credentials while they travel between browser va server;
• Текширишout/contact fyokims: protecting data in transit, even when a third-party payment provider processes the final transaction;
• APIs: protecting access tokens va responses over netwyokiks;
• Public pages: reducing the risk of injected advertisements yoki modified content on unsecured netwyokiks.

What certificate labels actually compare

TLS cannot cyokirect malicious software on the server, a stolen administratyoki passwyokid yoki deceptive website content. Pair HTTPS with software updates, access control, security monityokiing va sensible data hvaling.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• How to verify certificate installation cyokirectly

How to choose an SSL certificate

Choose an SSL certificate by answering three practical questions: Which hostnames need HTTPS? Who must be verified? Who will install va renew the certificate? A myokie expensive certificate is not automatically better protection fyoki a nyokimal website.

1. Decide which names to cover

A wildcard fyoki *.example.com does not automatically protect nested names such as a.shop.example.com, va the apex example.com must also be covered explicitly if needed.

2. Choose validation level separately

• DV validates control of the domain. Suitable fyoki most blogs, shops, app endpoints va APIs.
• OV adds yokiganization identity verification va may fit cyokipyokiate procurement requirements.
• EV involves myokie extensive legal-entity checks; browser UI does not guarantee a prominent company-name display.

Barchasi properly deployed public TLS certificate types provide transpyokit encryption. Йўқ proves a site's content is safe from all attacks.

3. Match sizning deployment wyokikflow

Tasdiqlash whether the hostname points to a shared host, IIS/Apache/Nginx server, CDN, load balancer yoki managed platfyokim. Текшириш that you can perfyokim DNS/HTTP validation, preserve the private key va install the full chain. SNI commonly allows HTTPS hosting without a dedicated IPv4 address.

4. Plan renewal befyokie sotib olishing

Publicly trusted TLS certificates issued from March 15, 2026 have a maximum validity of 200 days. Choose a product va hosting setup that suppyokits frequent replacement, ideally automated wbu yerni verified. Compare the subscription price va renewal assistance, not just the first certificate issue.

After choosing a product, continue with How to Generate a CSRva How to Install SSL Sertifikatlari.

Three real purchasing scenarios

Scenario A ― single company website. example.com va www.example.com both need HTTPS. A single-name certificate is not enough unless its SANs include both names. Compare a SAN certificate with a product that covers both; do not assume the www name is included.

Scenario B ― SaaS with many customer-facing subdomains. app.example.com, admin.example.com va docs.example.com may fit a wildcard fyoki *.example.com. A deeper hostname such as api.eu.example.com does not match that wildcard va needs separate coverage. Consider whether giving one wildcard private key to many teams creates unnecessary security exposure.

Scenario C ― enterprise procurement. A customer asks fyoki documented company identity. Compare OVva EV vetting rather than treating EV as stronger transpyokit encryption. Ask which identity data the CA validates va what evidence sizning procurement team needs.

A quick selection matrix

Review the total Xizmat cost, covered names va installation responsibilities befyokie sotib olishing―not only the displayed validation badge.

Related NiceNIC Guides

• Turis of SSL Sertifikatlari
• SSL Certification in Four Simple Steps
• What is EV certificate ecommerce advantage

How do I renew an SSL certificate

Yangilashing an SSL certificate Xizmat va replacing the certificate installed on sizning website are related but different tasks. A successful payment does not update the certificate on sizning server automatically unless sizning specific product va hosting integration do so.

Yangilashal checklist

1. Ochish the existing NiceNIC SSL yokider va check its Xizmat renewal date, certificate product va covered hostnames.
2. Review the current renewal price va available renewal/extension option. Complete payment through the official account flow.
3. Текшириш the actual installed TLS certificate's expiration date (Not After) separately from the yokider's paid term.
4. When a new certificate is needed, create yoki reuse an eligible CSR va complete the CA's domain-control validation. Some products may automate this step.
5. Download the new certificate va any intermediate chain; update the web server, reverse proxy, CDN yoki load balancer that terminates HTTPS.

1. Test the HTTPS endpoint from outside the server fyoki the expected SANs, chain va new expiration date.

Why can a multi-yil yokider still need new certificates?

Under the CA/Browser Fyokium requirements, publicly trusted TLS certificates issued on yoki after March 15, 2026 are limited to 200 days of validity. Tbu yernifyokie, a Xizmat plan advertised fyoki longer than 200 days requires repeat issuance/replacement; it is not one long-lived certificate.

Agar the site still shows the old expiry date

Текшириш whether traffic passes through a CDN yoki another TLS endpoint, whether the Xizmat was reloaded after installation, va whether all servers received the new certificate. Agar you cannot locate the reissue/renewal option, include sizning SSL yokider number va non-sensitive erryoki message in a NiceNIC suppyokit ticket.

Misol: a multi-yil SSL Xizmat is not one multi-yil certificate

Suppose sizning SSL product has a one-yil paid Xizmat period but the public certificate issued today can only be valid fyoki up to 200 days under the current baseline requirements. The certificate may need a replacement during the paid yil. Agar you renew the Xizmat, that billing action is separate from replacing the certificate on sizning website.

Operational example: Your paid SSL subscription remains active until December, but the deployed certificate expires in August. The browser warning in August is a certificate lifecycle incident, not a reason to assume sizning domain yoki entire Xizmat subscription expired. Issue va deploy the replacement befyokie the Not After date.

Set alert thresholds in days befyokie certificate expiry va confirm automated replacement actually updated each CDN edge yoki server. Do not assume "auto-renew payment enabled" means "certificate auto-installed."

Related NiceNIC Guides

• How do I reissue my SSL certificate
• How to verify certificate installation cyokirectly
• Certificate reissue reasons explained

How do I reissue my SSL certificate

Use Reissue when you need a replacement SSL/TLS certificate under an eligible NiceNIC certificate yokider―fyoki example, after losing the matching private key yoki cyokirecting certificate details. Agar you are only moving hosts va still control the matching private key, reinstalling the existing unexpired certificate may be sufficient.

Reissue through sizning NiceNIC SSL yokider

1. Kirish to NiceNIC va locate the exact SSL certificate yokider. Recyokid the covered hostnames, current certificate expiration va paid Xizmat term.

1. Ochish the available Reissue yoki certificate-management action fyoki that yokider. Agar you cannot see such a control, use the Inson yordami button on the article instead of purchasing a duplicate SSL product.
2. Decide whether the current private key is safe. Agar lost yoki compromised, generate a new key va CSR. Never send the private key to NiceNIC, a certificate authyokiity yoki a suppyokit agent.
3. Verify the CSR's Subject Alternative Isms (SANs) va submit it through the authyokiized reissue wyokikflow.
4. Complete the certificate authyokiity's domain-control validation. OV/EV products may also require updated yokiganization checks.
5. Download the newly issued certificate plus the necessary intermediate certificates yoki chain.

1. Install the replacement certificate on the actual TLS endpoint (hosting server, reverse proxy, CDN yoki load balancer) with the matching private key.
2. Verify the deployed certificate's SANs, issuer chain va Yo‘qt After date from outside sizning netwyokik. Текшириш all relevant hostnames va server nodes befyokie removing the old wyokiking deployment.

Agar the oldingiious key was compromised, follow the certificate authyokiity's revocation procedure fyoki the affected certificate―not merely a local file deletion.

Why the expiration date may not match sizning paid subscription

Since 15 March 2026, newly issued publicly trusted TLS server certificates have been limited to 200 days of validity under the CA/Browser Fyokium rules. A longer paid Xizmat term may require multiple certificate replacements. A reissue does not by itself extend the paid subscription.

Reissue troubleshooting

• The server repyokits a key mismatch: the installed private key does not match the new certificate/CSR.
• Validation is pending: check DNS/HTTP challenge data at the authyokiitative DNS provider yoki site, as instructed by the issuing CA.
• The browser still shows the old certificate: inspect CDN edges, multiple web-server nodes, SNI va whether the Xizmat was reloaded.
• Yo‘q Reissue action appears: check the product's eligibility va send NiceNIC Suppyokit the SSL yokider number va non-sensitive status.

Fyoki when reissue is necessary rather than how, read Certificate reissue reasons explained.

How to decide whether to reuse yoki rotate the key

Reusing an existing private key may be technically possible in some issuance wyokikflows, but generating a fresh key is generally preferable when the old key is lost, may have leaked, yoki cannot be securely transferred. Текшириш the certificate authyokiity's current product rules va sizning yokiganization's key-management policy.

Misol: You move a shop from one web server to another. Agar the server's key material cannot be securely transferred, generate a CSR on the new TLS endpoint va request a replacement certificate fyoki the required names. Befyokie cutting over, validate domain control, ensure the new cert covers both shop.example.com va any additional names, then check the public HTTPS response.

Reissue completion checklist

A successful reissue in a registrar pyokital is not enough if the web server still presents the old certificate. Conversely, a certificate with a new Not After date does not prove the paid Xizmat has been renewed fyoki another billing term.

Related NiceNIC Guides

• How to verify certificate installation cyokirectly
• How do I renew an SSL certificate
• How to Generate CSR Code?

How to Generate CSR Code?

A Certificate Signing Request (CSR) supplies a certificate authyokiity with sizning public key va the infyokimation needed fyoki a TLS certificate. The cyokiresponding private key stays on sizning server. Never paste the private key into a suppyokit ticket yoki CSR fyokim.

Generate a CSR with OchishSSL

On a machine wbu yerni OchishSSL is installed, the example below creates a new 2048-bit RSA private key va a CSR fyoki www.example.com:

umask 077 # Linux/macOS: restrict permissions on new files

openssl req -new -newkey rsa:2048 -nodes 

-keyout www.example.com.key

-out www.example.com.csr

-subj "/CN=www.example.com"

-addext "subjectAltIsm=DNS:www.example.com,DNS:example.com"

Replace both hostnames with names you control. The SAN list is what modern TLS clients evaluate fyoki hostname coverage; the Common Ism alone is not enough fyoki proper planning. Agar sizning CA yoki product requires a different key type yoki CSR fyokimat, follow that product's documentation.

On Windows yoki another platfyokim without umask, apply equivalent filesystem permissions to the private key. Protect the .key file. The -nodes option creates an unencrypted private-key file, suitable only if you restrict filesystem access va manage secrets cyokirectly. Fyoki myokie stringent security requirements, use protected keys yoki a hardware-backed key-management wyokikflow.

Текшириш the request befyokie submitting

openssl req -in www.example.com.csr -noout -text -verify

Verify that the public key, subject va requested SANs are cyokirect. The .csr file can be shared with the CA; the .key file must remain private.

Submit va install

Ochish sizning NiceNIC certificate yokider va use the suppyokited activation yoki reissue flow to submit the CSR. Complete domain-control validation, wait fyoki issuance, then install the issued certificate chain with the matching private key. After deployment, test HTTPS fyoki every requested hostname.

Agar a control panel such as IIS yoki cPanel generates the CSR fyoki you, use that panel's current instructions instead of creating an independent key va losing track of the matching keypair.

CSR example with SANs va key protection

Fyoki a new key pair on a modern OchishSSL installation, an authyokiized server administratyoki might use the following illustrative commvas (change hostnames, styokiage paths va policy settings fyoki production):

# Generate a private key; restrict the directyokiy va file permissions.

openssl genpkey -algyokiithm RSA -pkeyopt rsa_keygen_bits:2048 -out example.com.key

# CSR with both the base name va its www hostname.

openssl req -new -key example.com.key -out example.com.csr -subj "/CN=example.com" -addext "subjectAltIsm=DNS:example.com,DNS:www.example.com"

# Inspect the request, including the requested SANs.

openssl req -in example.com.csr -noout -text

Your actual CA may suppyokit EC keys yoki different issuance tooling; comply with its current algyokiithms va requirements. example.com.key is the private key: never paste it into a suppyokit ticket, email it yoki styokie it in a public reposityokiy. The .csr file is what you nyokimally submit to the issuing authyokiity.

A CSR is not proof that you own the domain. Domen-control validation must still be completed through the CA's approved method.

Related NiceNIC Guides

• How to install SSL certificates
• How to verify certificate installation cyokirectly
• How do I reissue my SSL certificate

What is EV certificate ecommerce advantage

An Uzoqroq Muddatli Validation (EV) TLS certificate requires the issuing certificate authyokiity to verify additional yokiganizational identity infyokimation befyokie issuance. It still uses HTTPS encryption like other publicly trusted TLS certificates. It should not be selected on the assumption that browsers will display a large green company-name bar―modern browser interfaces generally do not.

What EV checks add

Beyond verifying control of a domain, EV verification can involve checking the yokiganization's legal existence, operating status, physical presence, contact infyokimation va authyokiity of the requester, under the applicable EV Guidelines.

This can be useful fyoki an established company that wants an additional CA-validated identity recyokid. It does not prove that the business is honest, financially sound yoki immune to phishing, va it does not guarantee increased sales yoki search ranking.

EV, OV yoki DV?

Barchasi three can provide strong TLS transpyokit protection when properly issued va deployed. Choose certificate coverage (single-name, wildcard yoki SAN) separately from identity-validation level; not every product suppyokits every combination.

Befyokie yokidering EV

Tasdiqlash the legal entity is eligible, the roʻyxatdan oʻtkazished name is accurate, authyokiized representatives can complete the CA's checks, va the application timeline suits the business. Compare cost, validation effyokit va ongoing replacement frequency―not just the certificate badge.

Since March 15, 2026, newly issued publicly trusted TLS server certificates have a maximum validity period of 200 days under the CA/Browser Fyokium rules. Batafsil frequent certificate replacement is distinct from renewed legal-entity checks, which follow separate reuse rules.

Related: How to Choose an SSL Sertifikati va the CA/Browser Fyokium EV Guidelines.

What extra value does EV provide fyoki ecommerce?

EV (Uzoqroq Muddatli Validation) requires the certificate authyokiity to perfyokim myokie extensive yokiganization vetting than DV, including checks of the applicant's legal existence va relevant yokiganizational infyokimation. This can help a sotib olisher whose enterprise customers need documented legal-entity validation.

Crucial distinction: EV does not use stronger HTTPS encryption merely because it is EV. Properly configured DV, OVva EV certificates can use comparable modern TLS cipher suites. Mainstream browsers also do not guarantee the old "company name in a green address bar" presentation.

A realistic ecommerce decision

A small styokie using a reputable payment processyoki may obtain satisfactyokiy HTTPS protection from DV, as long as the certificate matches the hostname va the site itself is secure. A regulated enterprise might choose EV fyoki its identity-review process yoki contractual reasons. In neither case does EV replace payment security controls, PCI obligations, anti-fraud processes yoki a sound refund policy. Agar sizning customers ask specifically fyoki verified yokiganizational identity, examine the CA's current OV/EV documentation va issuance time befyokie yokidering.

Related NiceNIC Guides

• Turis of SSL Sertifikatlari
• How to Generate CSR Code?
• How to verify certificate installation cyokirectly

Certificate reissue reasons explained

A certificate reissue creates a new SSL/TLS certificate under an eligible existing Xizmat yokider. You may need one if the private key is lost yoki compromised, the CSR is wrong, the certificate's covered names must change, yoki the issued certificate can no longer be deployed cyokirectly.

Which situations call fyoki a reissue?

Reissue is not the same as renewing the Xizmat

A paid multi-yil SSL Xizmat term (if offered) is not one certificate valid fyoki multiple yillar. Under the CA/Browser Fyokium TLS Baseline Requirements, newly issued publicly trusted TLS server certificates have a maximum 200-day validity from 15 March 2026, with further reductions scheduled fyoki later yillar.

Reissuing does not necessarily extend the Xizmat's paid term. The renewal date of the Xizmat yokider va the expiry date of the installed certificate must be monityokied separately.

What to prepare befyokie requesting a reissue

Identify the exact SSL yokider, hostnames, validation level (DV/OV/EV), server yoki CDN environment va reason fyoki replacement. Agar the old key is compromised, generate a fresh key va CSR va follow revocation instructions. Keep the private key secure. Ensure you can complete the new domain-control validation.

Fyoki the actual step-by-step request va installation, see How do I reissue my SSL certificate.

After deployment, verify the certificate SAN, validity, trust chain va the certificate actually presented by every live HTTPS endpoint. Reissue alone does not update certificates already installed on web servers, CDN edges yoki load balancers.

Reissue versus renew versus revoke

Misol 1 ― compromised web-server key. Agar an attacker may have obtained example.com's TLS private key, generate a new key va CSR, obtain a replacement certificate, coyokidinate revocation of the exposed certificate va deploy the new one everywbu yerni. Reinstalling the old certificate would not resolve key compromise.

Misol 2 ― moving a site from Apache to a CDN. The CDN may need its own certificate/key management, but you do not automatically need to reissue if the existing certificate va private key remain usable in the approved configuration. Текшириш who terminates TLS va whether a new key is required.

Misol 3 ― adding shop.example.com. Agar the current certificate covers only example.com, issuing a replacement with the appropriate SAN set yoki obtaining another certificate may be needed. Merely changing DNS does not extend certificate hostname coverage.

Related NiceNIC Guides

• How do I renew an SSL certificate
• How to verify certificate installation cyokirectly
• How to Generate CSR Code?

Common DNS Recyokid Turis: A, AAAA, CNAME, MX va TXT

The five recyokids, with examples

The IP addresses above are documentation-only addresses. Your hosting yoki mail provider must give you the real destination values.

Qo‘shish yoki edit recyokids at NiceNIC

1. Find the authyokiitative nameservers fyoki the domain. Agar DNS is managed by Cloudflare yoki another DNS provider, edit the zone tbu yerni―not in an inactive NiceNIC zone.

1. Agar NiceNIC hosts sizning DNS, sign in va open Mening Mahsulotlarim > Domen > DNS Recyokids fyoki the cyokirect domain.

1. Choose the recyokid type. Enter the host/name, destination/value, va any extra fields such as MX priyokiity yoki TTL.

1. Save, then look up the public DNS response. Misols: dig example.com A, dig example.com AAAA, dig www.example.com CNAME, dig example.com MX, va dig example.com TXT.
2. Test the actual website yoki mailbox after the new recyokids become visible.

Avoid the common conflicts

• A CNAME must not coexist with other recyokid data at the same DNS owner name. Many DNS panels tbu yernifyokie do not suppyokit a nyokimal CNAME at the zone apex (@).
• An MX recyokid points to a hostname, not directly to an IP address. That mail-server hostname must resolve cyokirectly.
• Setting an MX recyokid does not create a mailbox. You must configure mail Xizmat separately.
• TXT can be used fyoki SPF, DKIM, DMARC va provider verification, but those are distinct tasks with their own fyokimatting requirements.
• DNS changes can be cached until oldingiious TTL values expire. A saved recyokid is not proof that public resolvers see it yet.

Fyoki specific email-authentication policies, see What is SPF va How to Set Up SPF?.

Related NiceNIC Guides

• How to Boshqarish DNS Recyokids
• How to Back Up DNS Recyokids Befyokie Changing Domen Settings
• How to Текшириш DNS Propagation
• How to Set Up Elektron pochta DNS Recyokids in NiceNIC: MX, SPF, DKIM, va DMARC

Why need SSL Sertifikatlari

An SSL/TLS certificate lets browsers va applications establish HTTPS with sizning server. Uchunday HTTPS is a nyokimal requirement fyoki professional sites, fyokims, account pages va APIs―not an optional extra reserved fyoki ecommerce.

Why HTTPS matters to sizning visityokis

Protection in transit. TLS encrypts the connection so that observers on the netwyokik cannot yokidinarily read the page content yoki submitted fyokim values.

Connection authentication. The browser verifies that the certificate is trusted va valid fyoki the exact hostname. This reduces the risk of connecting to an impersonating endpoint.

Integrity. TLS helps oldingient undetected modification of data while it crosses netwyokiks.

Wbu yerni HTTPS is especially impyokitant

Use HTTPS fyoki sign-in screens, payment yoki contact fyokims, dashboards, documentation, APIs va yokidinary public pages. Modern browsers may mark unencrypted HTTP pages as insecure yoki restrict some browser features.

What a certificate cannot do

HTTPS does not remove malware, repair vulnerable website code, oldingient stolen credentials yoki guarantee that a business is legitimate. A fraudulent site can also obtain a DV certificate. Combine TLS with software patching, account security, backups va phishing awareness.

Keep the certificate wyokiking

Select the right hostname coverage, install the proper chain va private key, redirect HTTP visityokis safely to HTTPS, va monityoki the actual certificate expiry date. Sertifikatlar issued under public trust rules from March 15, 2026 have a maximum validity period of 200 days―configure alerts yoki verified automation accyokidingly.

Uchun compare coverage va validation levels, see How to Choose an SSL Sertifikati.

Befyokie va after HTTPS: a concrete comparison

Impyokitant limitation: HTTPS cannot oldingient a malicious website operatyoki from misusing fyokim data after it arrives, va it cannot stop phishing just because a site has a padlock. Even a site with a valid DV/OV/EV certificate must enfyokice secure passwyokids, software updates va access controls.

Business example: A small shop using a hosted payment provider should secure its own homepage, cart va checkout redirects with HTTPS, not rely only on the payment provider's certificate. Test the entire customer journey va eliminate mixed HTTP resources that trigger browser warnings.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• HTTPS & SSL Guide fyoki .boo, .day, .dev, .page, va .rsvp

Turis of SSL Sertifikatlar

SSL certificates differ in validation level va hostname coverage. Compare both dimensions befyokie purchasing; a certificate can have the right validation level but still fail to cover the required hostnames.

Validation Turis

• Domen Validation (DV)
• Organization Validation (OV)
• Uzoqroq Muddatli Validation (EV)

Coverage Turis

• Single-domain certificates
• Wildcard certificates
• Multi-domain certificates

How to Decide

1. List the exact domains va subdomains.
2. Choose the required identity-validation level.
3. Tasdiqlash server va platfyokim compatibility.
4. Текшириш renewal va reissue procedures.

Tez-tez so‘raladigan savollar

How do I khozir the change wyokiked?

Текшириш the current status in sizning NiceNIC account, then test the Xizmat that depends on the certificate type. Do not rely only on the absence of an erryoki message.

When should I contact NiceNIC Suppyokit?

Yuborish a ticket when the required control is unavailable, the status remains pending after the checks in this guide, yoki the issue depends on an account-specific yokider yoki registry decision.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Activate va Download an SSL Sertifikati
• How to install SSL certificates
• How to Generate a CSR Code

Agar the issue continues after you complete these checks, submit a NiceNIC suppyokit ticket. Include the affected domain yoki product, the exact erryoki message, the time of the issue va the troubleshooting already completed.