Understanding SSL Leaf Level Certificates and Yearly Renewals

Authorize.net recommends that your site and applications trust the Root and Intermediate CA SSL certificates rather than the server-level certificate. This method eliminates the need to update or install the latest leaf certificate, which is updated annually before their expiration dates. If your application trusts only the Root and Intermediate level certificates, there is no need to install the certificates attached to this article.

Latest Update:

The most recent update will follow the schedule below, and the most current certificates are attached as of: [Date].

This latest update involves a complete certificate change. For more details, refer to the support article: Entrust to DigiCert SSL Certificate Migration

Sandbox: August 15th, 2024
Production: September 17th, 2024

Impacted API endpoints:

Sandbox URLs

• test.authorize.net
• apitest.authorize.net

Production URLs

• secure.authorize.net
• secure2.authorize.net
• api.authorize.net
• api2.authorize.net

Procedure to Obtain Authorize.net SSL Certificate if Required

1. Navigate to the API endpoint your solution/host is communicating with. This will depend on the API and environment being integrated or connected to. Please refer to your developer/solution provider or the Developer Center and see: Authorize.net Domains and IP Addresses.
2. Download the root and intermediate certificates from DigiCert:
   • To download the Root Certificate (DigiCert Global Root):
     • Select File > Properties > Certificates > Certification Path tab.
     • Choose the highest level of the certification path tree: 'Entrust.net'.
     • Click View Certificate > Details tab > Copy to File... > Next > Next.
     • Enter a filename (suggested filename: entrust_net.crt) and click Next > Finish.
   • To download the Intermediate Certificate (DigiCert SHA2 Secure Server CA)
     • Select File > Properties > Certificates > Certification Path tab.
     • Choose the second level of the certification path tree: 'Entrust Certification Authority - L1K'.
     • Click View Certificate > Details tab > Copy to File... > Next > Next.
     • Enter a filename (suggested filename: digicert_global_root.crt) and click Next > Finish.

Alternative Options for Obtaining the Certificates:

• Obtain from Entrust directly: DigiCert Root Certificates Download
• Use SSL Labs:
  1. Go to SSL Labs
  2. Enter the API endpoint/url
  3. Click Submit
  4. Review the Certificate section of the results.
  5. Use the download option for the leaf cert and intermediate/root CA as needed.