Available in🇮🇳 India🇲🇾 Malaysia🇸🇬 Singapore🇺🇸 United States
Your integration connects to Razorpay Curlec over HTTPS. Razorpay Curlec’s SSL certificate proves that you are connected to Razorpay Curlec’s services and keeps the traffic private. This page explains what your integration must support, why you should not pin our certificate, and what to do if your security policy requires pinning.
Upcoming SSL certificate renewal: October 05, 2026, 10:00 PM ISTIf your integration pins or whitelists Razorpay Curlec’s certificate, review the guidance on this page and complete the required changes before this date.
Prerequisites
Before proceeding, determine if your application uses:- SSL certificate pinning
- Certificate whitelisting
- Custom certificate trust stores
No Action Needed for Third-Party Platform UsersIf you use a third-party platform such as WooCommerce, Magento, CS Cart, OpenCart, Shopify, WHMCS, Arastta, Prestashop, WordPress, Easy Digital Downloads, WIX, BigCommerce or Drupal Commerce, you are not required to take any action. The platform handles SSL management. Read FAQ #3 and FAQ #4 for more details.The same applies if you use Razorpay Curlec-hosted products such as Payment Links, Payment Pages, Payment Buttons or Invoices.
Requirements
Your systems must support TLS 1.2 or higher. TLS 1.3 is preferred.TLS certificates
When you connect, our server presents a chain of certificates. Your client checks that the chain ends at a root it already trusts.- Leaf certificate: Razorpay Curlec’s own certificate for
*.razorpay.com. It is renewed every few months. - Intermediate certificate: issued by the certificate authority; it signs the leaf and can change without notice.
- Root certificate: the long-lived trust anchor built into operating systems and browsers. Roots stay valid for many years.
Certificate pinning
Razorpay Curlec does not recommend certificate pinning. If you use certificate pinning, your system only accepts the certificate that you pinned for Razorpay Curlec. When we renew our SSL certificate and present a different one during the TLS handshake, your application refuses to connect to Razorpay Curlec, even though the new certificate is issued by a trusted certificate authority (CA). Why Razorpay Curlec does not support certificate pinning of any kind:- Outside of Razorpay Curlec’s control: your system handles certificate pinning. We do not know whether you pin, or which certificates you pin.
- Risk of failing connections: when we renew our certificate and your system still expects the previous one, your connection to Razorpay Curlec breaks. Our certificate is now renewed every few months.
Certificate changes
If your security policy requires certificate pinning, do the following to reduce the risk of broken connections. Only pin the root certificates: instead of pinning the leaf certificate or the entire certificate chain, you must pin all of the following root certificates. Razorpay Curlec no longer publishes per-certificate files (X*.pem):Fingerprints and serial numbers (for verification)
Fingerprints and serial numbers (for verification)
Download the root certificates only from the CAs’ official repositories: DigiCert · Amazon Trust Services. Verify each download against the fingerprints above:
- Regular business practice: we publish the new root on this page at least 30 days before our servers start using it.
- Emergency cases: the notice period can be shorter before we make the change.
Certificate trust store updates
If you have a certificate trust store in your server environment that is not configured to update automatically, you must ensure that it contains all the root certificates listed above. Refer to this manual to learn how to update trust stores in different environments.Verify your setup
Before each announced change, the upcoming certificate is served on a test endpoint ahead of production. Connect to it to confirm your setup:Additional Support
If you encounter any difficulties during the process, our support team is here to help:- Log in to the Dashboard.
- Navigate to the Help & Support section at the bottom right.
- Raise a ticket under the Technical Assistance category to contact our tech support team.
FAQs
I have received an email about a certificate change, or I am a new Razorpay Curlec user. Do I need to take action?
I have received an email about a certificate change, or I am a new Razorpay Curlec user. Do I need to take action?
Not unless you have manually pinned or installed a Razorpay Curlec certificate in your applications or servers. Otherwise your systems validate our certificate through the standard trust store of your operating system or platform, and the change is invisible to you. If you have pinned one, remove it or pin all the root certificates listed on this page.
I previously downloaded the X9 or X10 certificate files. What should I do now?
I previously downloaded the X9 or X10 certificate files. What should I do now?
Remove the pinned or installed Razorpay Curlec certificate and let your system use standard SSL validation. If your security policy requires pinning, replace the old files with all the root certificates listed on this page. Per-certificate files (X*.pem and chain files) are no longer published.
How do I check whether I am using a third-party platform?
How do I check whether I am using a third-party platform?
Third-party platforms are services such as WooCommerce, Magento, CS Cart, OpenCart, Shopify, WHMCS, Arastta, Prestashop, WordPress, Easy Digital Downloads, WIX, BigCommerce and Drupal Commerce. If you are unsure, check whether you use an admin panel provided by one of these platforms to add stock, offers or perform other tasks. If yes, you are using a third-party platform.
If I am using a third-party platform, do I need to take action?
If I am using a third-party platform, do I need to take action?
No. The platform manages the connection to Razorpay Curlec and handles SSL validation for you. See the list of platforms in the box near the top of this page.
What are leaf, intermediate and root certificates?
What are leaf, intermediate and root certificates?
When you connect to Razorpay Curlec, our server sends three certificates in a chain. The leaf is our own certificate, and it changes every few months. The intermediate belongs to the certificate authority, and it can change at any time. The root is built into your operating system or browser and stays the same for many years. That is why only root certificates are safe to pin. See TLS certificates for more.
Why can I no longer pin Razorpay Curlec's certificate?
Why can I no longer pin Razorpay Curlec's certificate?
Industry rules now limit how long any SSL certificate may be valid, so Razorpay Curlec’s certificate will be renewed every few months instead of once a year. A pin on the certificate or its intermediate breaks at every renewal. Root certificates stay valid for many years, which is why only root pinning is supported.
What do I gain by removing certificate pinning instead of pinning the root certificates?
What do I gain by removing certificate pinning instead of pinning the root certificates?
Nothing to maintain, ever. With pinning removed, your system trusts Razorpay Curlec the same way it trusts every other website: through the certificate authorities built into your operating system or platform. Certificate renewals, a change of certificate authority, even a change to the root list need no action from you.No risk of an outage from a stale pin. Every pinned integration is one missed update away from failed payments. Root pinning reduces that risk but does not remove it: the root list can still change, and someone has to act within the notice period.No loss of security. Standard validation already checks that the certificate is issued for razorpay.com by a trusted authority and has not expired or been revoked. Pinning adds protection only against a certificate wrongly issued by a trusted authority, a risk the industry now covers through Certificate Transparency logs and CAA records rather than client-side pins. This is why Razorpay Curlec, like other major payment providers and certificate authorities, advises against pinning.
Which root certificate should I pin? Only the one used today?
Which root certificate should I pin? Only the one used today?
We strongly recommend that you do not pin at all; standard certificate validation is enough and needs no maintenance.If your security policy requires pinning, pin all the root certificates listed on this page, not only the one in today’s chain. Razorpay Curlec may issue certificates under any of them, and any change to this list will be announced on this page at least 30 days in advance.
My server keeps its own certificate trust store. What do I need to do?
My server keeps its own certificate trust store. What do I need to do?
Make sure your trust store has all the root certificates listed on this page. This matters most on servers that do not update automatically, such as locked-down Windows servers. If you maintain your own bundle manually, start from the Mozilla CA bundle published by curl and add any of the roots above that it does not include. See Certificate trust store updates for how to update it.
Do I need to update my Razorpay Curlec SDK?
Do I need to update my Razorpay Curlec SDK?
We recommend that everyone uses the latest version of the Razorpay Curlec SDK for their platform. Current SDKs use an up-to-date trusted certificate list, either from your operating system or language runtime or bundled with the SDK, that already contains the root certificates on this page, so certificate renewals need no change on your side.You can find the latest versions of our SDKs and plugins at razorpay.com/integrations.
How can I make sure my services remain uninterrupted after a renewal?
How can I make sure my services remain uninterrupted after a renewal?
Test before the renewal date. Connect to
https://api-ssl-test.razorpay.com from your system. If it connects without an SSL or certificate error, you are ready. See Verify your setup for the exact commands.