Skip to main content
Your integration connects to Razorpay Curlec over HTTPS. Razorpay Curlec’s SSL certificate proves that you are connected to Razorpay Curlec’s services and keeps the traffic private. This page explains what your integration must support, why you should not pin our certificate, and what to do if your security policy requires pinning.
Upcoming SSL certificate renewal: October 05, 2026, 10:00 PM ISTIf your integration pins or whitelists Razorpay Curlec’s certificate, review the guidance on this page and complete the required changes before this date.

​
Prerequisites

Before proceeding, determine if your application uses:
  • SSL certificate pinning
  • Certificate whitelisting
  • Custom certificate trust stores
No action is required if your systems have never been configured to use, trust, or manually install a specific Razorpay Curlec SSL certificate, including through SSL pinning or certificate whitelisting. This includes any configurations previously made by your team. Your systems will automatically trust the renewed certificate.
No Action Needed for Third-Party Platform UsersIf you use a third-party platform such as WooCommerce, Magento, CS Cart, OpenCart, Shopify, WHMCS, Arastta, Prestashop, WordPress, Easy Digital Downloads, WIX, BigCommerce or Drupal Commerce, you are not required to take any action. The platform handles SSL management. Read FAQ #3 and FAQ #4 for more details.The same applies if you use Razorpay Curlec-hosted products such as Payment Links, Payment Pages, Payment Buttons or Invoices.

​
Requirements

Your systems must support TLS 1.2 or higher. TLS 1.3 is preferred.

​
TLS certificates

When you connect, our server presents a chain of certificates. Your client checks that the chain ends at a root it already trusts.
  • Leaf certificate: Razorpay Curlec’s own certificate for *.razorpay.com. It is renewed every few months.
  • Intermediate certificate: issued by the certificate authority; it signs the leaf and can change without notice.
  • Root certificate: the long-lived trust anchor built into operating systems and browsers. Roots stay valid for many years.
For a fuller explanation, see DigiCert: how certificate chains work and Let’s Encrypt: chain of trust.

​
Certificate pinning

Razorpay Curlec does not recommend certificate pinning. If you use certificate pinning, your system only accepts the certificate that you pinned for Razorpay Curlec. When we renew our SSL certificate and present a different one during the TLS handshake, your application refuses to connect to Razorpay Curlec, even though the new certificate is issued by a trusted certificate authority (CA). Why Razorpay Curlec does not support certificate pinning of any kind:
  • Outside of Razorpay Curlec’s control: your system handles certificate pinning. We do not know whether you pin, or which certificates you pin.
  • Risk of failing connections: when we renew our certificate and your system still expects the previous one, your connection to Razorpay Curlec breaks. Our certificate is now renewed every few months.
Watch Out!If you have pinned or whitelisted a Razorpay Curlec certificate, remove it and rely on standard SSL validation. Pinning adds no practical protection for your integration and can stop your payments at every renewal.

​
Certificate changes

If your security policy requires certificate pinning, do the following to reduce the risk of broken connections. Only pin the root certificates: instead of pinning the leaf certificate or the entire certificate chain, you must pin all of the following root certificates. Razorpay Curlec no longer publishes per-certificate files (X*.pem):
Download the root certificates only from the CAs’ official repositories: DigiCert · Amazon Trust Services. Verify each download against the fingerprints above:
Keep track of root certificate updates: even if you pin all the root certificates, Razorpay Curlec may add a new root certificate to this list in future.
  • Regular business practice: we publish the new root on this page at least 30 days before our servers start using it.
  • Emergency cases: the notice period can be shorter before we make the change.
It is your responsibility to ensure your applications (for example, web or mobile) can handle any certificate changes.
Never pin the leaf certificate, the intermediate certificate, or the certificate chainRazorpay Curlec updates these certificates routinely and without notice. Any integration that pins them will break at the next rotation.

​
Certificate trust store updates

If you have a certificate trust store in your server environment that is not configured to update automatically, you must ensure that it contains all the root certificates listed above. Refer to this manual to learn how to update trust stores in different environments.

​
Verify your setup

Before each announced change, the upcoming certificate is served on a test endpoint ahead of production. Connect to it to confirm your setup:
If the connection succeeds without an SSL or certificate error, your system is ready for the renewal.
Watch Out!This is only a test domain (api-ssl-test.razorpay.com) and should not be used in production environments.

​
Additional Support

If you encounter any difficulties during the process, our support team is here to help:
  1. Log in to the Dashboard.
  2. Navigate to the Help & Support section at the bottom right.
  3. Raise a ticket under the Technical Assistance category to contact our tech support team.

​
FAQs

Not unless you have manually pinned or installed a Razorpay Curlec certificate in your applications or servers. Otherwise your systems validate our certificate through the standard trust store of your operating system or platform, and the change is invisible to you. If you have pinned one, remove it or pin all the root certificates listed on this page.
Remove the pinned or installed Razorpay Curlec certificate and let your system use standard SSL validation. If your security policy requires pinning, replace the old files with all the root certificates listed on this page. Per-certificate files (X*.pem and chain files) are no longer published.
Third-party platforms are services such as WooCommerce, Magento, CS Cart, OpenCart, Shopify, WHMCS, Arastta, Prestashop, WordPress, Easy Digital Downloads, WIX, BigCommerce and Drupal Commerce. If you are unsure, check whether you use an admin panel provided by one of these platforms to add stock, offers or perform other tasks. If yes, you are using a third-party platform.
No. The platform manages the connection to Razorpay Curlec and handles SSL validation for you. See the list of platforms in the box near the top of this page.
When you connect to Razorpay Curlec, our server sends three certificates in a chain. The leaf is our own certificate, and it changes every few months. The intermediate belongs to the certificate authority, and it can change at any time. The root is built into your operating system or browser and stays the same for many years. That is why only root certificates are safe to pin. See TLS certificates for more.
Industry rules now limit how long any SSL certificate may be valid, so Razorpay Curlec’s certificate will be renewed every few months instead of once a year. A pin on the certificate or its intermediate breaks at every renewal. Root certificates stay valid for many years, which is why only root pinning is supported.
Nothing to maintain, ever. With pinning removed, your system trusts Razorpay Curlec the same way it trusts every other website: through the certificate authorities built into your operating system or platform. Certificate renewals, a change of certificate authority, even a change to the root list need no action from you.No risk of an outage from a stale pin. Every pinned integration is one missed update away from failed payments. Root pinning reduces that risk but does not remove it: the root list can still change, and someone has to act within the notice period.No loss of security. Standard validation already checks that the certificate is issued for razorpay.com by a trusted authority and has not expired or been revoked. Pinning adds protection only against a certificate wrongly issued by a trusted authority, a risk the industry now covers through Certificate Transparency logs and CAA records rather than client-side pins. This is why Razorpay Curlec, like other major payment providers and certificate authorities, advises against pinning.
We strongly recommend that you do not pin at all; standard certificate validation is enough and needs no maintenance.If your security policy requires pinning, pin all the root certificates listed on this page, not only the one in today’s chain. Razorpay Curlec may issue certificates under any of them, and any change to this list will be announced on this page at least 30 days in advance.
Make sure your trust store has all the root certificates listed on this page. This matters most on servers that do not update automatically, such as locked-down Windows servers. If you maintain your own bundle manually, start from the Mozilla CA bundle published by curl and add any of the roots above that it does not include. See Certificate trust store updates for how to update it.
We recommend that everyone uses the latest version of the Razorpay Curlec SDK for their platform. Current SDKs use an up-to-date trusted certificate list, either from your operating system or language runtime or bundled with the SDK, that already contains the root certificates on this page, so certificate renewals need no change on your side.You can find the latest versions of our SDKs and plugins at razorpay.com/integrations.
Test before the renewal date. Connect to https://api-ssl-test.razorpay.com from your system. If it connects without an SSL or certificate error, you are ready. See Verify your setup for the exact commands.