Skip to main content
Available in🇮🇳 India🇲🇾 Malaysia🇸🇬 Singapore🇺🇸 United States
Your integration connects to Razorpay over HTTPS. Razorpay’s SSL certificate proves that you are connected to Razorpay’s services and keeps the traffic private. This page explains what your integration must support, why you should not pin our certificate, and what to do if your security policy requires pinning.
Upcoming SSL certificate renewal: October 05, 2026, 10:00 PM ISTIf your integration pins or whitelists Razorpay’s certificate, review the guidance on this page and complete the required changes before this date.

​
Prerequisites

Before proceeding, determine if your application uses:
  • SSL certificate pinning
  • Certificate whitelisting
  • Custom certificate trust stores
No action is required if your systems have never been configured to use, trust, or manually install a specific Razorpay SSL certificate, including through SSL pinning or certificate whitelisting. This includes any configurations previously made by your team. Your systems will automatically trust the renewed certificate.
No Action Needed for Third-Party Platform UsersIf you use a third-party platform such as WooCommerce, Magento, CS Cart, OpenCart, Shopify, WHMCS, Arastta, Prestashop, WordPress, Easy Digital Downloads, WIX, BigCommerce or Drupal Commerce, you are not required to take any action. The platform handles SSL management. Read FAQ #3 and FAQ #4 for more details.The same applies if you use Razorpay-hosted products such as Payment Links, Payment Pages, Payment Buttons or Invoices.

​
Requirements

Your systems must support TLS 1.2 or higher. TLS 1.3 is preferred.

​
TLS certificates

When you connect, our server presents a chain of certificates. Your client checks that the chain ends at a root it already trusts.
  • Leaf certificate: Razorpay’s own certificate for *.razorpay.com. It is renewed every few months.
  • Intermediate certificate: issued by the certificate authority; it signs the leaf and can change without notice.
  • Root certificate: the long-lived trust anchor built into operating systems and browsers. Roots stay valid for many years.
For a fuller explanation, see DigiCert: how certificate chains work and Let’s Encrypt: chain of trust.

​
Certificate pinning

Razorpay does not recommend certificate pinning. If you use certificate pinning, your system only accepts the certificate that you pinned for Razorpay. When we renew our SSL certificate and present a different one during the TLS handshake, your application refuses to connect to Razorpay, even though the new certificate is issued by a trusted certificate authority (CA). Why Razorpay does not support certificate pinning of any kind:
  • Outside of Razorpay’s control: your system handles certificate pinning. We do not know whether you pin, or which certificates you pin.
  • Risk of failing connections: when we renew our certificate and your system still expects the previous one, your connection to Razorpay breaks. Our certificate is now renewed every few months.
Watch Out!If you have pinned or whitelisted a Razorpay certificate, remove it and rely on standard SSL validation. Pinning adds no practical protection for your integration and can stop your payments at every renewal.

​
Certificate changes

If your security policy requires certificate pinning, do the following to reduce the risk of broken connections. Only pin the root certificates: instead of pinning the leaf certificate or the entire certificate chain, you must pin all of the following root certificates. Razorpay no longer publishes per-certificate files (X*.pem):
Download the root certificates only from the CAs’ official repositories: DigiCert · Amazon Trust Services. Verify each download against the fingerprints above:
Keep track of root certificate updates: even if you pin all the root certificates, Razorpay may add a new root certificate to this list in future.
  • Regular business practice: we publish the new root on this page at least 30 days before our servers start using it.
  • Emergency cases: the notice period can be shorter before we make the change.
It is your responsibility to ensure your applications (for example, web or mobile) can handle any certificate changes.
Never pin the leaf certificate, the intermediate certificate, or the certificate chainRazorpay updates these certificates routinely and without notice. Any integration that pins them will break at the next rotation.

​
Certificate trust store updates

If you have a certificate trust store in your server environment that is not configured to update automatically, you must ensure that it contains all the root certificates listed above. Refer to this manual to learn how to update trust stores in different environments.

​
Verify your setup

Before each announced change, the upcoming certificate is served on a test endpoint ahead of production. Connect to it to confirm your setup:
If the connection succeeds without an SSL or certificate error, your system is ready for the renewal.
Watch Out!This is only a test domain (api-ssl-test.razorpay.com) and should not be used in production environments.

​
Additional Support

If you encounter any difficulties during the process, our support team is here to help:
  1. Log in to the Dashboard.
  2. Navigate to the Help & Support section at the bottom right.
  3. Raise a ticket under the Technical Assistance category to contact our tech support team.

​
FAQs

Not unless you have manually pinned or installed a Razorpay certificate in your applications or servers. Otherwise your systems validate our certificate through the standard trust store of your operating system or platform, and the change is invisible to you. If you have pinned one, remove it or pin all the root certificates listed on this page.
Remove the pinned or installed Razorpay certificate and let your system use standard SSL validation. If your security policy requires pinning, replace the old files with all the root certificates listed on this page. Per-certificate files (X*.pem and chain files) are no longer published.
Third-party platforms are services such as WooCommerce, Magento, CS Cart, OpenCart, Shopify, WHMCS, Arastta, Prestashop, WordPress, Easy Digital Downloads, WIX, BigCommerce and Drupal Commerce. If you are unsure, check whether you use an admin panel provided by one of these platforms to add stock, offers or perform other tasks. If yes, you are using a third-party platform.
No. The platform manages the connection to Razorpay and handles SSL validation for you. See the list of platforms in the box near the top of this page.
When you connect to Razorpay, our server sends three certificates in a chain. The leaf is our own certificate, and it changes every few months. The intermediate belongs to the certificate authority, and it can change at any time. The root is built into your operating system or browser and stays the same for many years. That is why only root certificates are safe to pin. See TLS certificates for more.
Industry rules now limit how long any SSL certificate may be valid, so Razorpay’s certificate will be renewed every few months instead of once a year. A pin on the certificate or its intermediate breaks at every renewal. Root certificates stay valid for many years, which is why only root pinning is supported.
Nothing to maintain, ever. With pinning removed, your system trusts Razorpay the same way it trusts every other website: through the certificate authorities built into your operating system or platform. Certificate renewals, a change of certificate authority, even a change to the root list need no action from you.No risk of an outage from a stale pin. Every pinned integration is one missed update away from failed payments. Root pinning reduces that risk but does not remove it: the root list can still change, and someone has to act within the notice period.No loss of security. Standard validation already checks that the certificate is issued for razorpay.com by a trusted authority and has not expired or been revoked. Pinning adds protection only against a certificate wrongly issued by a trusted authority, a risk the industry now covers through Certificate Transparency logs and CAA records rather than client-side pins. This is why Razorpay, like other major payment providers and certificate authorities, advises against pinning.
We strongly recommend that you do not pin at all; standard certificate validation is enough and needs no maintenance.If your security policy requires pinning, pin all the root certificates listed on this page, not only the one in today’s chain. Razorpay may issue certificates under any of them, and any change to this list will be announced on this page at least 30 days in advance.
Make sure your trust store has all the root certificates listed on this page. This matters most on servers that do not update automatically, such as locked-down Windows servers. If you maintain your own bundle manually, start from the Mozilla CA bundle published by curl and add any of the roots above that it does not include. See Certificate trust store updates for how to update it.
We recommend that everyone uses the latest version of the Razorpay SDK for their platform. Current SDKs use an up-to-date trusted certificate list, either from your operating system or language runtime or bundled with the SDK, that already contains the root certificates on this page, so certificate renewals need no change on your side.You can find the latest versions of our SDKs and plugins at razorpay.com/integrations.
Test before the renewal date. Connect to https://api-ssl-test.razorpay.com from your system. If it connects without an SSL or certificate error, you are ready. See Verify your setup for the exact commands.