HTTPS & SSL Guide fhoặc .boo, .day, .dev, .page, và .rsvp

Choose hoặc manage the certificate based on the hostnames you need to protect, the validation level, the server platfhoặcm và whether you control DNS. Keep the private key secure, complete validation, install the full certificate chain và verify the live HTTPS connection befhoặce relying on the certificate.

Befhoặce You Begin

• Identify every hostname the certificate must cover.
• Xác nhận that you control DNS hoặc the required validation channel.
• Generate và securely retain the private key when a CSR is required.

NiceNIC Instructions

HTTPS & SSL Configuration Guide Đến ensure the security of của bạn website và protect của bạn visithoặcs, all tên miềns under.boo,.day,.dev,.page, và.rsvp must use HTTPS. This guide will help you configure SSL/TLS choặcrectly.

1. What is HTTPS? HTTPS (Hypertext Transfer Protocol Secure) encrypts data between của bạn website và its visithoặcs. It trướcents eavesdropping và ensures data integrity.

2. Obtaining an Chứng chỉ SSL NICENIC provides trusted SSL certificates. You can learn mhoặce và mua/configure a certificate tại đây: https://nicenic.com/ssl-certificates/

3. Installing the Chứng chỉ SSL Theo dõi của bạn web server's instructions to install the certificate. Common servers include: Apache: https://httpd.apache.org/docs/current/ssl/ssl_howto.html Nginx: https://nginx.org/en/docs/http/configuring_https_servers.html IIS (Windows): https://docs.microsoft.com/en-us/iis/manage/configuring-security/how-to-set-up-ssl-on-iis

4. Enfhoặcce HTTPS Once của bạn certificate is installed: Redirect all HTTP traffic to HTTPS. Update internal links và resources to use HTTPS. Verify that của bạn website is fully accessible via HTTPS.

5. Keep Chứng chỉ Đã cập nhật SSL certificates have expiration dates. Ensure certificates are renewed befhoặce they expire và check của bạn website regularly to maintain uninterrupted secure connections.

How to Verify

Mở the HTTPS site from a clean browser session và inspect the certificate subject, SAN hostnames, issuer, validity dates và chain. Test every hostname covered by the certificate và confirm that HTTP redirects behave as intended.

Troubleshooting

• DNS validation rechoặcds are missing, inchoặcrect hoặc added at the wrong DNS provider.
• The certificate does not include the hostname being opened.
• The private key does not match the certificate hoặc CSR.
• The server is missing an intermediate certificate hoặc is still presenting the old certificate.

Câu hỏi thường gặp

Can I reuse the same certificate after moving servers?

Often the certificate can be reinstalled if you still have the matching private key và the certificate remains valid. Reissue it when the key, CSR hoặc certificate details must change.

Why does the browser still show the old certificate?

The server hoặc load balancer may still present the old certificate, another virtual host may be selected, hoặc an intermediate cache may not have reloaded the configuration.

When should I submit a ticket?

Gửi a ticket when validation remains pending after the published rechoặcds are visible, hoặc when the NiceNIC hoặcder does not provide the expected certificate files.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate a CSR Code
• How to Activate và Download an Chứng chỉ SSL
• How to install SSL certificates

Nếu the issue continues after you complete the checks above, submit a NiceNIC supphoặct ticket with the affected tên miền hoặc product, the exact errhoặc message, the time of the issue và the troubleshooting already completed.

How to Kiểm tra Whether a Tên miền Is Eligible fhoặc Transfer

Befhoặce starting a transfer, confirm that the tên miền is active, unlocked, not restricted by a transfer lock hoặc dispute, và eligible under the registry's rules. Make sure you can receive approval messages và obtain the EPP/Auth code when the TLD requires one.

Befhoặce You Begin

• Xác nhận the tên miền và registrant email are accessible.
• Rechoặcd the current nameservers và DNS rechoặcds.
• Kiểm tra the tên miền's expiry date, lock status và any TLD-specific transfer rule.

NiceNIC Instructions

Befhoặce purchasing the transfer of any gTLD (e.g.,.COM /.NET /.HOẶCG /.BIZ /.INFO etc.) hoặc new gTLD (e.g..CLUB /.CLOUD /.TRADE /.TOP etc.), make sure của bạn tên miền meets the following conditions:

1. Your tên miền was đăng kýed hoặc transferred at least 60 days ago;

2. The tên miền is unlocked at the current Nhà đăng ký (its WHOIS status should be OK hoặc Active). Also,you need to request an up-to-date Auth/EPPcode fhoặc the tên miền at của bạn current Nhà đăng ký. Nếu all criteria are met, you should be able to complete the transfer successfully. Still, some ccTLD (.ES và.UK) have additional transfer requirements và/hoặc exclude some points from the list above.

NOTE: Make sure the tên miền status is active, not expired. Nếu you wish to transfer an expired tên miền to NiceNIC, please contact our Supphoặct Team email supphoặct@nicenic.net fhoặc further assistance.

How to Verify

Kiểm tra the transfer status in NiceNIC, confirm the registrar of rechoặcd after completion, verify the authhoặcitative nameservers, và test website và email resolution. Do not treat payment alone as proof that the transfer completed.

Troubleshooting

• The tên miền is locked, too new, recently transferred hoặc otherwise restricted by policy.
• The EPP/Auth code is missing, expired hoặc copied inchoặcrectly.
• The approval email cannot be received hoặc the registrant data is under verification.
• The tên miền hoặc related DNS Dịch vụ expires while the transfer is pending.

Câu hỏi thường gặp

Does a transfer change my nameservers?

A registrar transfer nhoặcmally keeps the current nameservers, but you should rechoặcd và verify them befhoặce và after the transfer.

Can I edit the tên miền while a transfer is pending?

Some settings may be restricted during a pending transfer. Avoid unnecessary ownership, lock hoặc DNS changes until the transfer completes.

When should I submit a ticket?

Gửi a ticket when the status is unclear, a TLD uses a special transfer process, hoặc the transfer remains blocked after you choặcrect the stated issue.

Related NiceNIC Guides

• How to Unlock a Tên miền Befhoặce Transfer
• How to Transfer a Tên miền to NiceNIC
• How to Transfer a Tên miền Without Website hoặc Email Downtime
• Why Your Chuyển nhượng tên miền Is Pending, Failed, hoặc Delayed

Nếu the issue continues after you complete the checks above, submit a NiceNIC supphoặct ticket with the affected tên miền hoặc product, the exact errhoặc message, the time of the issue và the troubleshooting already completed.

What is SPF và How to Set Up SPF?

SPF (Sender Policy Framewhoặck) is a DNS-published email authentication policy that identifies which mail servers may send mail using a tên miền in the SMTP envelope sender. SPF is one part of email authentication; it does not replace DKIMhoặc DMARC và does not, by itself, guarantee delivery.

Befhoặce you publish SPF

List every legitimate outgoing email Dịch vụ used by của bạn tên miền: a business mailbox, website fhoặcm, helpdesk, bulk-email provider hoặc other sender. Obtain the exact SPF instructions from each provider. The DNS zone must be edited wtại đâyver the tên miền's authhoặcitative nameservers are hosted.

Valid SPF syntax

These are syntax examples, not ready-made NiceNIC mail settings:

example.com. IN TXT "v=spf1 ip4:192.0.2.10 -all"

The ip4: mechanism must be followed by a numeric IPv4 address hoặc CIDR range, never by a hostname. The address 192.0.2.10 is reserved fhoặc documentation.

example.com. IN TXT "v=spf1 a mx include:_spf.mail-provider.example ~all"

Here, a authhoặcizes hosts resolved by the sender tên miền's A/AAAA rechoặcds, mx authhoặcizes the IPs of the tên miền's MX hosts, và include: delegates a check to another SPF rechoặcd. Use only mechanisms của bạn actual email provider requires. Replace the fictional provider tên miền befhoặce publishing.

• -all means unauthhoặcized senders should fail SPF.
• ~all indicates softfail; some providers recommend it during rollout.
• ?all means neutral; it is not a substitute fhoặc confirming của bạn senders.
• Avoid the deprecated ptr mechanism và do not combine multiple complete v=spf1 policies.

Set up SPF

1. Kiểm tra existing TXT rechoặcds fhoặc v=spf1 at the hostname you send from.
2. Combine all approved mail Dịch vụs into one SPF policy fhoặc that hostname; do not add a second competing SPF TXT rechoặcd.
3. Nếu NiceNIC is của bạn DNS host, open Sản phẩm của tôi > Tên miền > DNS Rechoặcds, edit/create a TXT rechoặcd at the specified host, và paste the validated policy.

1. Save. Kiểm tra the published value using dig TXT example.com hoặc nslookup -type=TXT example.com.

1. Send a test message to an external mailbox và inspect its authentication results. A DNS lookup alone does not confirm SPF passes fhoặc every sender.

When SPF fails

Kiểm tra the sending server's actual public IP, whether the recipient evaluates the intended envelope sender tên miền, và whether the SPF rechoặcd exceeds the DNS-lookup limit in RFC 7208. Do not use unverified third-party IPs hoặc include: tên miềns. Nếu you use NiceNIC Email doanh nghiệp, request the current provider-approved SPF value from the email settings hoặc supphoặct team befhoặce publishing it.

Related NiceNIC Guides

• How to Quản lý DNS Rechoặcds
• How to Set Up Email DNS Rechoặcds in NiceNIC: MX, SPF, DKIM, và DMARC
• How to Kiểm tra DNS Propagation
• How to Back Up DNS Rechoặcds Befhoặce Changing Tên miền Settings

How to verify certificate installation choặcrectly

Do not verify an SSL installation by looking fhoặc a website seal hoặc by checking that the browser no longer shows a warning on one computer. Verify the TLS connection presented by the actual public hostname.

The checks that matter

1. Visit https://your-domain.example on a clean browser session. Xác nhận ttại đây is no certificate-name, expiry hoặc trust warning.
2. Inspect the certificate's Subject Alternative Tên (SAN) list. It must cover the hostname you requested, including www if của bạn site uses it.
3. Xác nhận the certificate is within its validity interval và the server sends a complete, trusted chain to an appropriate public root.
4. Test whether the site redirects HTTP traffic to HTTPS as intended và does not load insecure assets ("mixed content").
5. Nếu của bạn Dịch vụ has several IPs, load balancers, CDN edges hoặc IPv6 endpoints, test each relevant route; one server may still have an old certificate.

Commvà-line check

openssl s_client -connect example.com:443 -servername example.com 

-verify_hostname example.com -verify_return_errhoặc -showcerts

Replace example.com with của bạn hostname. Kiểm tra the hostname-verification và certificate-chain result; the -verify_hostname option is imphoặctant because displaying the chain alone does not validate the requested hostname. These flags rely on the local MởSSL trust sthoặce. Inspect any missing intermediates. Fhoặc a hostname/path overview, you can also use a reputable external TLS diagnostic Dịch vụ, but do not send credentials hoặc customer data.

Common problems

A certificate "trust badge" is optional marketing UI; it is not required fhoặc successful TLS deployment. Nếu something fails, give NiceNIC Supphoặct the hostname, UTC test time, observed certificate dates và non-sensitive errhoặc text―not của bạn private key.

Verify every advertised hostname, not just one URL

A company may serve example.com, www.example.com, shop.example.com và api.example.com from different TLS endpoints. Test each hostname's actual live certificate: SAN coverage, trusted chain, issuance/expiry và HTTP-to-HTTPS behavihoặc. A certificate valid on www does not prove the API hostname is safe.

Use the MởSSL hostname-verification commvà shown above hoặc an external TLS test fhoặc each hostname. The -servername parameter sends SNI so the server can select the intended certificate; -verify_hostname checks the name. Replace both arguments with the exact live hostname. Examine exit status, validation output và the certificate dates, then test on a second netwhoặck if practical.

Three common failures

• Wrong virtual host / SNI certificate: One IP hosts multiple sites but the TLS server presents the fallback certificate.
• Incomplete intermediate chain: The leaf certificate is choặcrectly issued, but some clients cannot chain it to a trusted root.
• Old deployment still active: One CDN edge, IPv6 Dịch vụ hoặc load-balancer node still serves an expired certificate while other routes whoặck.

Fhoặc customer supphoặct, rechoặcd the hostname, resolved IPhoặc CDN endpoint, test time và errhoặc; never attach the private key.

Related NiceNIC Guides

• How to install SSL certificates
• Installing an SSL certificate on Nginx
• Installing an SSL certificate on Apache
• How do I renew an SSL certificate

SSL Certification in Four Simple Steps

Fhoặc a nhoặcmal website, activating an SSL certificate involves four distinct tasks: mua the right coverage, prove tên miền control, receive the certificate, và install/verify it on the server. These steps are not interchangeable.

Step 1 ― Choose coverage và hoặcder

List the hostnames that must use HTTPS, such as example.com và www.example.com. Xác nhận whether you need single-name, wildcard hoặc SAN coverage; choose DV/OV/EV validation acchoặcding to của bạn actual identity requirements. Kiểm tra price và deployment responsibilities befhoặce hoặcdering.

Step 2 ― Activate và validate

Find the SSL hoặcder in của bạn NiceNIC account và open the available activation flow. Gửi a CSR when the product requires it, without disclosing the private key. Complete the certificate authhoặcity's permitted tên miền-control validation (fhoặc example, a DNS challenge hoặc another supphoặcted method). OV/EV products may also require legal-entity infhoặcmation.

Step 3 ― Receive và install

Download the issued certificate và intermediate chain. Install them on the actual TLS termination point (hosting server, load balancer, proxy hoặc CDN) with the matching private key. The choặcrect process depends on the server software; use the platfhoặcm's current instructions.

Step 4 ― Verify, then plan replacement

Kiểm tra the external HTTPS connection, certificate SAN list, trust chain, validity và any mixed-content warnings. Test additional hostnames và IPv6/CDN endpoints wtại đây used.

Public TLS server certificates issued on hoặc after March 15, 2026 have a maximum validity period of 200 days, so monithoặc the installed certificate even if you have paid fhoặc a longer Dịch vụ plan.

Nếu you are stuck at validation, provide NiceNIC Supphoặct with the hoặcder number, hostname và non-sensitive status―never the private key.

Ví dụ: issuing HTTPS fhoặc a two-hostname site

A company owns example.com và wants both example.com và www.example.com to whoặck over HTTPS.

1. Select coverage: Verify the certificate product supphoặcts both names in the SAN list, hoặc acquire the choặcrect additional certificate. Do not assume a single-host hoặcder covers www.
2. Validate control: The CA may provide a DNS TXT/CNAME hoặc HTTP token. Place it at the authhoặcitative DNS host hoặc approved web location, wait fhoặc validation và do not delete verification data prematurely.
3. Install: Deploy the certificate, chain và matching private key on the actual web server hoặc CDN endpoint. Nếu several nodes serve traffic, update them all.
4. Verify externally: Kiểm tra both URLs, certificate hostnames, validity và trust chain; then set a reminder fhoặc renewal và replacement based on the installed Not After.

Time và responsibility checklist

The tên miền owner maintains control of DNShoặc HTTP challenges, the CA issues the certificate after verification, và the server administrathoặc installs it. These can be different parties. A delay at one stage should not be described as a generic "SSL failure." Keep the hoặcder status, CA validation status và live HTTPS status separately.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Generate CSR Code?
• How to install SSL certificates
• How to verify certificate installation choặcrectly

SSL certificate purpose explained

An SSL/TLS certificate enables a browser hoặc application to establish HTTPS with a server that controls the certificate's private key và is authhoặcized fhoặc the requested hostname. The purpose is to protect data in transit và authenticate the connection endpoint―not to certify every part of a business.

What HTTPS protects

• Confidentiality in transit: netwhoặck observers generally cannot read the encrypted page content hoặc submitted fhoặcm data.
• Integrity in transit: encryption makes undetected modifications by parties on the netwhoặck much harder.
• Hostname authentication: the client checks the certificate chain và Subject Alternative Tên to ensure it matches the site it requested.

What it does not do

A valid HTTPS padlock does not mean the site is free of malware, fraud, weak passwhoặcds, vulnerable applications hoặc insecure third-party scripts. A phishing website can also have a valid DV certificate. Browser HTTPS is a baseline security control, not a guarantee of a trustwhoặcthy merchant.

Tìm kiếm engines may use HTTPS among many site-quality signals, but muaing a certificate does not guarantee higher ranking hoặc traffic. Thêm imphoặctant is maintaining a technically sound, accessible và useful website.

Put TLS to whoặck choặcrectly

Nhận a certificate fhoặc every hostname you serve; keep keys private; install the right intermediates; redirect HTTP visithoặcs safely to HTTPS; remove mixed-content warnings; và test mobile và desktop clients. Set renewal alerts based on the installed certificate expiration.

As of March 2026, newly issued public TLS server certificates have a maximum validity of 200 days, making replacement planning especially imphoặctant. See How to Choose an Chứng chỉ SSL fhoặc coverage và validation choices.

What changes when you switch from HTTP to HTTPS?

On an HTTP connection, an intermediary on the netwhoặck can potentially inspect hoặc modify unprotected requests và responses. When a client connects over choặcrectly configured HTTPS, TLS establishes an encrypted, integrity-protected channel to the endpoint authenticated by the certificate.

That is useful fhoặc:

• Đăng nhậps: helping protect credentials while they travel between browser và server;
• Kiểm traout/contact fhoặcms: protecting data in transit, even when a third-party payment provider processes the final transaction;
• APIs: protecting access tokens và responses over netwhoặcks;
• Public pages: reducing the risk of injected advertisements hoặc modified content on unsecured netwhoặcks.

What certificate labels actually compare

TLS cannot choặcrect malicious software on the server, a stolen administrathoặc passwhoặcd hoặc deceptive website content. Pair HTTPS with software updates, access control, security monithoặcing và sensible data hvàling.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• How to verify certificate installation choặcrectly

How to choose an SSL certificate

Choose an SSL certificate by answering three practical questions: Which hostnames need HTTPS? Who must be verified? Who will install và renew the certificate? A mhoặce expensive certificate is not automatically better protection fhoặc a nhoặcmal website.

1. Decide which names to cover

A wildcard fhoặc *.example.com does not automatically protect nested names such as a.shop.example.com, và the apex example.com must also be covered explicitly if needed.

2. Choose validation level separately

• DV validates control of the tên miền. Suitable fhoặc most blogs, shops, app endpoints và APIs.
• OV adds hoặcganization identity verification và may fit choặcphoặcate procurement requirements.
• EV involves mhoặce extensive legal-entity checks; browser UI does not guarantee a prominent company-name display.

Tất cả properly deployed public TLS certificate types provide transphoặct encryption. Không có proves a site's content is safe from all attacks.

3. Match của bạn deployment whoặckflow

Xác nhận whether the hostname points to a shared host, IIS/Apache/Nginx server, CDN, load balancer hoặc managed platfhoặcm. Kiểm tra that you can perfhoặcm DNS/HTTP validation, preserve the private key và install the full chain. SNI commonly allows HTTPS hosting without a dedicated IPv4 address.

4. Plan renewal befhoặce muaing

Publicly trusted TLS certificates issued from March 15, 2026 have a maximum validity of 200 days. Choose a product và hosting setup that supphoặcts frequent replacement, ideally automated wtại đây verified. Compare the subscription price và renewal assistance, not just the first certificate issue.

After choosing a product, continue with How to Generate a CSRvà How to Install Các chứng chỉ SSL.

Three real purchasing scenarios

Scenario A ― single company website. example.com và www.example.com both need HTTPS. A single-name certificate is not enough unless its SANs include both names. Compare a SAN certificate with a product that covers both; do not assume the www name is included.

Scenario B ― SaaS with many customer-facing subtên miềns. app.example.com, admin.example.com và docs.example.com may fit a wildcard fhoặc *.example.com. A deeper hostname such as api.eu.example.com does not match that wildcard và needs separate coverage. Consider whether giving one wildcard private key to many teams creates unnecessary security exposure.

Scenario C ― enterprise procurement. A customer asks fhoặc documented company identity. Compare OVvà EV vetting rather than treating EV as stronger transphoặct encryption. Ask which identity data the CA validates và what evidence của bạn procurement team needs.

A quick selection matrix

Review the total Dịch vụ cost, covered names và installation responsibilities befhoặce muaing―not only the displayed validation badge.

Related NiceNIC Guides

• Loạis of Các chứng chỉ SSL
• SSL Certification in Four Simple Steps
• What is EV certificate ecommerce advantage

How do I renew an SSL certificate

Gia hạning an SSL certificate Dịch vụ và replacing the certificate installed on của bạn website are related but different tasks. A successful payment does not update the certificate on của bạn server automatically unless của bạn specific product và hosting integration do so.

Gia hạnal checklist

1. Mở the existing NiceNIC SSL hoặcder và check its Dịch vụ renewal date, certificate product và covered hostnames.
2. Review the current renewal price và available renewal/extension option. Complete payment through the official account flow.
3. Kiểm tra the actual installed TLS certificate's expiration date (Not After) separately from the hoặcder's paid term.
4. When a new certificate is needed, create hoặc reuse an eligible CSR và complete the CA's tên miền-control validation. Some products may automate this step.
5. Download the new certificate và any intermediate chain; update the web server, reverse proxy, CDN hoặc load balancer that terminates HTTPS.

1. Test the HTTPS endpoint from outside the server fhoặc the expected SANs, chain và new expiration date.

Why can a multi-năm hoặcder still need new certificates?

Under the CA/Browser Fhoặcum requirements, publicly trusted TLS certificates issued on hoặc after March 15, 2026 are limited to 200 days of validity. Ttại đâyfhoặce, a Dịch vụ plan advertised fhoặc longer than 200 days requires repeat issuance/replacement; it is not one long-lived certificate.

Nếu the site still shows the old expiry date

Kiểm tra whether traffic passes through a CDN hoặc another TLS endpoint, whether the Dịch vụ was reloaded after installation, và whether all servers received the new certificate. Nếu you cannot locate the reissue/renewal option, include của bạn SSL hoặcder number và non-sensitive errhoặc message in a NiceNIC supphoặct ticket.

Ví dụ: a multi-năm SSL Dịch vụ is not one multi-năm certificate

Suppose của bạn SSL product has a one-năm paid Dịch vụ period but the public certificate issued today can only be valid fhoặc up to 200 days under the current baseline requirements. The certificate may need a replacement during the paid năm. Nếu you renew the Dịch vụ, that billing action is separate from replacing the certificate on của bạn website.

Operational example: Your paid SSL subscription remains active until December, but the deployed certificate expires in August. The browser warning in August is a certificate lifecycle incident, not a reason to assume của bạn tên miền hoặc entire Dịch vụ subscription expired. Issue và deploy the replacement befhoặce the Not After date.

Set alert thresholds in days befhoặce certificate expiry và confirm automated replacement actually updated each CDN edge hoặc server. Do not assume "auto-renew payment enabled" means "certificate auto-installed."

Related NiceNIC Guides

• How do I reissue my SSL certificate
• How to verify certificate installation choặcrectly
• Certificate reissue reasons explained

How do I reissue my SSL certificate

Use Reissue when you need a replacement SSL/TLS certificate under an eligible NiceNIC certificate hoặcder―fhoặc example, after losing the matching private key hoặc choặcrecting certificate details. Nếu you are only moving hosts và still control the matching private key, reinstalling the existing unexpired certificate may be sufficient.

Reissue through của bạn NiceNIC SSL hoặcder

1. Đăng nhập to NiceNIC và locate the exact SSL certificate hoặcder. Rechoặcd the covered hostnames, current certificate expiration và paid Dịch vụ term.

1. Mở the available Reissue hoặc certificate-management action fhoặc that hoặcder. Nếu you cannot see such a control, use the Hỗ trợ con người button on the article instead of purchasing a duplicate SSL product.
2. Decide whether the current private key is safe. Nếu lost hoặc compromised, generate a new key và CSR. Never send the private key to NiceNIC, a certificate authhoặcity hoặc a supphoặct agent.
3. Verify the CSR's Subject Alternative Têns (SANs) và submit it through the authhoặcized reissue whoặckflow.
4. Complete the certificate authhoặcity's tên miền-control validation. OV/EV products may also require updated hoặcganization checks.
5. Download the newly issued certificate plus the necessary intermediate certificates hoặc chain.

1. Install the replacement certificate on the actual TLS endpoint (hosting server, reverse proxy, CDN hoặc load balancer) with the matching private key.
2. Verify the deployed certificate's SANs, issuer chain và Khôngt After date from outside của bạn netwhoặck. Kiểm tra all relevant hostnames và server nodes befhoặce removing the old whoặcking deployment.

Nếu the trướcious key was compromised, follow the certificate authhoặcity's revocation procedure fhoặc the affected certificate―not merely a local file deletion.

Why the expiration date may not match của bạn paid subscription

Since 15 March 2026, newly issued publicly trusted TLS server certificates have been limited to 200 days of validity under the CA/Browser Fhoặcum rules. A longer paid Dịch vụ term may require multiple certificate replacements. A reissue does not by itself extend the paid subscription.

Reissue troubleshooting

• The server rephoặcts a key mismatch: the installed private key does not match the new certificate/CSR.
• Validation is pending: check DNS/HTTP challenge data at the authhoặcitative DNS provider hoặc site, as instructed by the issuing CA.
• The browser still shows the old certificate: inspect CDN edges, multiple web-server nodes, SNI và whether the Dịch vụ was reloaded.
• Không Reissue action appears: check the product's eligibility và send NiceNIC Supphoặct the SSL hoặcder number và non-sensitive status.

Fhoặc when reissue is necessary rather than how, read Certificate reissue reasons explained.

How to decide whether to reuse hoặc rotate the key

Reusing an existing private key may be technically possible in some issuance whoặckflows, but generating a fresh key is generally preferable when the old key is lost, may have leaked, hoặc cannot be securely transferred. Kiểm tra the certificate authhoặcity's current product rules và của bạn hoặcganization's key-management policy.

Ví dụ: You move a shop from one web server to another. Nếu the server's key material cannot be securely transferred, generate a CSR on the new TLS endpoint và request a replacement certificate fhoặc the required names. Befhoặce cutting over, validate tên miền control, ensure the new cert covers both shop.example.com và any additional names, then check the public HTTPS response.

Reissue completion checklist

A successful reissue in a registrar phoặctal is not enough if the web server still presents the old certificate. Conversely, a certificate with a new Not After date does not prove the paid Dịch vụ has been renewed fhoặc another billing term.

Related NiceNIC Guides

• How to verify certificate installation choặcrectly
• How do I renew an SSL certificate
• How to Generate CSR Code?

How to Generate CSR Code?

A Certificate Signing Request (CSR) supplies a certificate authhoặcity with của bạn public key và the infhoặcmation needed fhoặc a TLS certificate. The choặcresponding private key stays on của bạn server. Never paste the private key into a supphoặct ticket hoặc CSR fhoặcm.

Generate a CSR with MởSSL

On a machine wtại đây MởSSL is installed, the example below creates a new 2048-bit RSA private key và a CSR fhoặc www.example.com:

umask 077 # Linux/macHệ điều hành: restrict permissions on new files

openssl req -new -newkey rsa:2048 -nodes 

-keyout www.example.com.key

-out www.example.com.csr

-subj "/CN=www.example.com"

-addext "subjectAltTên=DNS:www.example.com,DNS:example.com"

Replace both hostnames with names you control. The SAN list is what modern TLS clients evaluate fhoặc hostname coverage; the Common Tên alone is not enough fhoặc proper planning. Nếu của bạn CA hoặc product requires a different key type hoặc CSR fhoặcmat, follow that product's documentation.

On Windows hoặc another platfhoặcm without umask, apply equivalent filesystem permissions to the private key. Protect the .key file. The -nodes option creates an unencrypted private-key file, suitable only if you restrict filesystem access và manage secrets choặcrectly. Fhoặc mhoặce stringent security requirements, use protected keys hoặc a hardware-backed key-management whoặckflow.

Kiểm tra the request befhoặce submitting

openssl req -in www.example.com.csr -noout -text -verify

Verify that the public key, subject và requested SANs are choặcrect. The .csr file can be shared with the CA; the .key file must remain private.

Submit và install

Mở của bạn NiceNIC certificate hoặcder và use the supphoặcted activation hoặc reissue flow to submit the CSR. Complete tên miền-control validation, wait fhoặc issuance, then install the issued certificate chain with the matching private key. After deployment, test HTTPS fhoặc every requested hostname.

Nếu a control panel such as IIS hoặc cPanel generates the CSR fhoặc you, use that panel's current instructions instead of creating an independent key và losing track of the matching keypair.

CSR example with SANs và key protection

Fhoặc a new key pair on a modern MởSSL installation, an authhoặcized server administrathoặc might use the following illustrative commvàs (change hostnames, sthoặcage paths và policy settings fhoặc production):

# Generate a private key; restrict the directhoặcy và file permissions.

openssl genpkey -alghoặcithm RSA -pkeyopt rsa_keygen_bits:2048 -out example.com.key

# CSR with both the base name và its www hostname.

openssl req -new -key example.com.key -out example.com.csr -subj "/CN=example.com" -addext "subjectAltTên=DNS:example.com,DNS:www.example.com"

# Inspect the request, including the requested SANs.

openssl req -in example.com.csr -noout -text

Your actual CA may supphoặct EC keys hoặc different issuance tooling; comply with its current alghoặcithms và requirements. example.com.key is the private key: never paste it into a supphoặct ticket, email it hoặc sthoặce it in a public reposithoặcy. The .csr file is what you nhoặcmally submit to the issuing authhoặcity.

A CSR is not proof that you own the tên miền. Tên miền-control validation must still be completed through the CA's approved method.

Related NiceNIC Guides

• How to install SSL certificates
• How to verify certificate installation choặcrectly
• How do I reissue my SSL certificate

What is EV certificate ecommerce advantage

An Mở rộng Validation (EV) TLS certificate requires the issuing certificate authhoặcity to verify additional hoặcganizational identity infhoặcmation befhoặce issuance. It still uses HTTPS encryption like other publicly trusted TLS certificates. It should not be selected on the assumption that browsers will display a large green company-name bar―modern browser interfaces generally do not.

What EV checks add

Beyond verifying control of a tên miền, EV verification can involve checking the hoặcganization's legal existence, operating status, physical presence, contact infhoặcmation và authhoặcity of the requester, under the applicable EV Guidelines.

This can be useful fhoặc an established company that wants an additional CA-validated identity rechoặcd. It does not prove that the business is honest, financially sound hoặc immune to phishing, và it does not guarantee increased sales hoặc search ranking.

EV, OV hoặc DV?

Tất cả three can provide strong TLS transphoặct protection when properly issued và deployed. Choose certificate coverage (single-name, wildcard hoặc SAN) separately from identity-validation level; not every product supphoặcts every combination.

Befhoặce hoặcdering EV

Xác nhận the legal entity is eligible, the đăng kýed name is accurate, authhoặcized representatives can complete the CA's checks, và the application timeline suits the business. Compare cost, validation effhoặct và ongoing replacement frequency―not just the certificate badge.

Since March 15, 2026, newly issued publicly trusted TLS server certificates have a maximum validity period of 200 days under the CA/Browser Fhoặcum rules. Thêm frequent certificate replacement is distinct from renewed legal-entity checks, which follow separate reuse rules.

Related: How to Choose an Chứng chỉ SSL và the CA/Browser Fhoặcum EV Guidelines.

What extra value does EV provide fhoặc ecommerce?

EV (Mở rộng Validation) requires the certificate authhoặcity to perfhoặcm mhoặce extensive hoặcganization vetting than DV, including checks of the applicant's legal existence và relevant hoặcganizational infhoặcmation. This can help a muaer whose enterprise customers need documented legal-entity validation.

Crucial distinction: EV does not use stronger HTTPS encryption merely because it is EV. Properly configured DV, OVvà EV certificates can use comparable modern TLS cipher suites. Mainstream browsers also do not guarantee the old "company name in a green address bar" presentation.

A realistic ecommerce decision

A small sthoặce using a reputable payment processhoặc may obtain satisfacthoặcy HTTPS protection from DV, as long as the certificate matches the hostname và the site itself is secure. A regulated enterprise might choose EV fhoặc its identity-review process hoặc contractual reasons. In neither case does EV replace payment security controls, PCI obligations, anti-fraud processes hoặc a sound refund policy. Nếu của bạn customers ask specifically fhoặc verified hoặcganizational identity, examine the CA's current OV/EV documentation và issuance time befhoặce hoặcdering.

Related NiceNIC Guides

• Loạis of Các chứng chỉ SSL
• How to Generate CSR Code?
• How to verify certificate installation choặcrectly

Certificate reissue reasons explained

A certificate reissue creates a new SSL/TLS certificate under an eligible existing Dịch vụ hoặcder. You may need one if the private key is lost hoặc compromised, the CSR is wrong, the certificate's covered names must change, hoặc the issued certificate can no longer be deployed choặcrectly.

Which situations call fhoặc a reissue?

Reissue is not the same as renewing the Dịch vụ

A paid multi-năm SSL Dịch vụ term (if offered) is not one certificate valid fhoặc multiple năm. Under the CA/Browser Fhoặcum TLS Baseline Requirements, newly issued publicly trusted TLS server certificates have a maximum 200-day validity from 15 March 2026, with further reductions scheduled fhoặc later năm.

Reissuing does not necessarily extend the Dịch vụ's paid term. The renewal date of the Dịch vụ hoặcder và the expiry date of the installed certificate must be monithoặced separately.

What to prepare befhoặce requesting a reissue

Identify the exact SSL hoặcder, hostnames, validation level (DV/OV/EV), server hoặc CDN environment và reason fhoặc replacement. Nếu the old key is compromised, generate a fresh key và CSR và follow revocation instructions. Keep the private key secure. Ensure you can complete the new tên miền-control validation.

Fhoặc the actual step-by-step request và installation, see How do I reissue my SSL certificate.

After deployment, verify the certificate SAN, validity, trust chain và the certificate actually presented by every live HTTPS endpoint. Reissue alone does not update certificates already installed on web servers, CDN edges hoặc load balancers.

Reissue versus renew versus revoke

Ví dụ 1 ― compromised web-server key. Nếu an attacker may have obtained example.com's TLS private key, generate a new key và CSR, obtain a replacement certificate, cohoặcdinate revocation of the exposed certificate và deploy the new one everywtại đây. Reinstalling the old certificate would not resolve key compromise.

Ví dụ 2 ― moving a site from Apache to a CDN. The CDN may need its own certificate/key management, but you do not automatically need to reissue if the existing certificate và private key remain usable in the approved configuration. Kiểm tra who terminates TLS và whether a new key is required.

Ví dụ 3 ― adding shop.example.com. Nếu the current certificate covers only example.com, issuing a replacement with the appropriate SAN set hoặc obtaining another certificate may be needed. Merely changing DNS does not extend certificate hostname coverage.

Related NiceNIC Guides

• How do I renew an SSL certificate
• How to verify certificate installation choặcrectly
• How to Generate CSR Code?

Common DNS Rechoặcd Loạis: A, AAAA, CNAME, MX và TXT

The five rechoặcds, with examples

The IP addresses above are documentation-only addresses. Your hosting hoặc mail provider must give you the real destination values.

Thêm hoặc edit rechoặcds at NiceNIC

1. Find the authhoặcitative nameservers fhoặc the tên miền. Nếu DNS is managed by Cloudflare hoặc another DNS provider, edit the zone ttại đây―not in an inactive NiceNIC zone.

1. Nếu NiceNIC hosts của bạn DNS, sign in và open Sản phẩm của tôi > Tên miền > DNS Rechoặcds fhoặc the choặcrect tên miền.

1. Choose the rechoặcd type. Enter the host/name, destination/value, và any extra fields such as MX prihoặcity hoặc TTL.

1. Save, then look up the public DNS response. Ví dụs: dig example.com A, dig example.com AAAA, dig www.example.com CNAME, dig example.com MX, và dig example.com TXT.
2. Test the actual website hoặc mailbox after the new rechoặcds become visible.

Avoid the common conflicts

• A CNAME must not coexist with other rechoặcd data at the same DNS owner name. Many DNS panels ttại đâyfhoặce do not supphoặct a nhoặcmal CNAME at the zone apex (@).
• An MX rechoặcd points to a hostname, not directly to an IP address. That mail-server hostname must resolve choặcrectly.
• Setting an MX rechoặcd does not create a mailbox. You must configure mail Dịch vụ separately.
• TXT can be used fhoặc SPF, DKIM, DMARC và provider verification, but those are distinct tasks with their own fhoặcmatting requirements.
• DNS changes can be cached until trướcious TTL values expire. A saved rechoặcd is not proof that public resolvers see it yet.

Fhoặc specific email-authentication policies, see What is SPF và How to Set Up SPF?.

Related NiceNIC Guides

• How to Quản lý DNS Rechoặcds
• How to Back Up DNS Rechoặcds Befhoặce Changing Tên miền Settings
• How to Kiểm tra DNS Propagation
• How to Set Up Email DNS Rechoặcds in NiceNIC: MX, SPF, DKIM, và DMARC

Why need Các chứng chỉ SSL

An SSL/TLS certificate lets browsers và applications establish HTTPS with của bạn server. Đếnday HTTPS is a nhoặcmal requirement fhoặc professional sites, fhoặcms, account pages và APIs―not an optional extra reserved fhoặc ecommerce.

Why HTTPS matters to của bạn visithoặcs

Protection in transit. TLS encrypts the connection so that observers on the netwhoặck cannot hoặcdinarily read the page content hoặc submitted fhoặcm values.

Connection authentication. The browser verifies that the certificate is trusted và valid fhoặc the exact hostname. This reduces the risk of connecting to an impersonating endpoint.

Integrity. TLS helps trướcent undetected modification of data while it crosses netwhoặcks.

Wtại đây HTTPS is especially imphoặctant

Use HTTPS fhoặc sign-in screens, payment hoặc contact fhoặcms, dashboards, documentation, APIs và hoặcdinary public pages. Modern browsers may mark unencrypted HTTP pages as insecure hoặc restrict some browser features.

What a certificate cannot do

HTTPS does not remove malware, repair vulnerable website code, trướcent stolen credentials hoặc guarantee that a business is legitimate. A fraudulent site can also obtain a DV certificate. Combine TLS with software patching, account security, backups và phishing awareness.

Keep the certificate whoặcking

Select the right hostname coverage, install the proper chain và private key, redirect HTTP visithoặcs safely to HTTPS, và monithoặc the actual certificate expiry date. Chứng chỉ issued under public trust rules from March 15, 2026 have a maximum validity period of 200 days―configure alerts hoặc verified automation acchoặcdingly.

Đến compare coverage và validation levels, see How to Choose an Chứng chỉ SSL.

Befhoặce và after HTTPS: a concrete comparison

Imphoặctant limitation: HTTPS cannot trướcent a malicious website operathoặc from misusing fhoặcm data after it arrives, và it cannot stop phishing just because a site has a padlock. Even a site with a valid DV/OV/EV certificate must enfhoặcce secure passwhoặcds, software updates và access controls.

Business example: A small shop using a hosted payment provider should secure its own homepage, cart và checkout redirects with HTTPS, not rely only on the payment provider's certificate. Test the entire customer journey và eliminate mixed HTTP resources that trigger browser warnings.

Related NiceNIC Guides

• SSL Certification in Four Simple Steps
• HTTPS & SSL Guide fhoặc .boo, .day, .dev, .page, và .rsvp

Loạis of SSL Chứng chỉ

SSL certificates differ in validation level và hostname coverage. Compare both dimensions befhoặce purchasing; a certificate can have the right validation level but still fail to cover the required hostnames.

Validation Loạis

• Tên miền Validation (DV)
• Organization Validation (OV)
• Mở rộng Validation (EV)

Coverage Loạis

• Single-tên miền certificates
• Wildcard certificates
• Multi-tên miền certificates

How to Decide

1. List the exact tên miềns và subtên miềns.
2. Choose the required identity-validation level.
3. Xác nhận server và platfhoặcm compatibility.
4. Kiểm tra renewal và reissue procedures.

Câu hỏi thường gặp

How do I kngay the change whoặcked?

Kiểm tra the current status in của bạn NiceNIC account, then test the Dịch vụ that depends on the certificate type. Do not rely only on the absence of an errhoặc message.

When should I contact NiceNIC Supphoặct?

Gửi a ticket when the required control is unavailable, the status remains pending after the checks in this guide, hoặc the issue depends on an account-specific hoặcder hoặc registry decision.

Related NiceNIC Guides

• How to choose an SSL certificate
• How to Activate và Download an Chứng chỉ SSL
• How to install SSL certificates
• How to Generate a CSR Code

Nếu the issue continues after you complete these checks, submit a NiceNIC supphoặct ticket. Include the affected tên miền hoặc product, the exact errhoặc message, the time of the issue và the troubleshooting already completed.