# TLS Certificates

Learn how to make sure your integration securely communicates with Stripe.

Your integration connects to Stripe’s API securely over [HTTPS](https://en.wikipedia.org/wiki/HTTPS)—the HTTP protocol encrypted over a [Transport Layer Security (TLS)](https://en.wikipedia.org/wiki/Transport_Layer_Security) connection. Whether you use Stripe managed SDKs, curl, or other HTTP clients to connect to Stripe APIs, TLS ensures that you’re connecting to Stripe servers and that third parties can’t read or modify API requests or responses.

[TLS certificates](https://www.digicert.com/tls-ssl/tls-ssl-certificates) are how your integration verifies it’s connecting to a Stripe-owned server. A digital certificate includes (but isn’t limited to) the host name of the server, information about the owner of the server/domain, duration of validity, and the identity of a trusted [certificate authority (CA)](https://en.wikipedia.org/wiki/Certificate_authority) that issued or signed this certificate. A client connecting to the server performs [path validation](https://en.wikipedia.org/wiki/Certification_path_validation_algorithm) on the certificate where it verifies that the subject field of the certificate matches the domain name of the server that it’s trying to connect to, the certificate isn’t expired, and that a trusted CA issued the certificate. For more details, you can [read about certificates](https://en.wikipedia.org/wiki/Public_key_certificate).

## Download the root certificates 

To update the root certificates your integration trusts, download Stripe’s current CA bundle and configure your HTTP client or Stripe SDK to use it:

- [PEM certificate bundle](https://stripe.com/files/tls/root_certificates.pem): Use this file as the CA bundle for HTTP clients that connect to Stripe.
- [JSON manifest](https://stripe.com/files/tls/root_certificates.json): Contains the name, subject, serial number, SHA-1 and SHA-256 fingerprints, expiration date, and PEM encoding of each certificate.

Stripe updates both files when the list of root certificates changes. If you store a copy of the bundle, replace it with the latest version before each announced change takes effect.

To use the bundle with a Stripe server-side SDK, configure the SDK to trust your copy of the file. The examples show a test key for illustration, but you must load your key from an environment variable or secrets manager instead of embedding it in code (see [best practices for managing secret keys](https://docs.stripe.com/keys-best-practices.md)).

#### Ruby

```ruby
# Set this before creating a Stripe::StripeClient.
Stripe.ca_bundle_path = "/path/to/root_certificates.pem"
```

You can subscribe to the [API announce mailing list](https://groups.google.com/a/lists.stripe.com/g/api-announce) to be notified of any changes to our root certificates. We provide 7 days notice through that mailing list before making changes.

## Certificate pinning

When you connect to Stripe API endpoints, certificates load from a CA certificates bundle that your operating system provides, or from browser or Stripe Bindings (depending on the HTTP client used for this connection). These certificates are treated as valid trusted certificates during certificate path validation. Certificate pinning is the process of restricting which certificates are considered valid for a particular HTTPS website or endpoint. Stripe recommends against certificate pinning to avoid complications with your integration when we roll out new certificates for our systems. DigiCert, one of the major CAs, also recommends against [certificate pinning](https://www.digicert.com/blog/certificate-pinning-what-is-certificate-pinning).

As a Stripe user, if you must use certificate pinning for some reason, make sure you pin *only* (and **all** of) the [root certificates for Stripe domains](https://docs.stripe.com/tls-certificates.md#root-certificates-for-stripe-domains). Do **NOT** pin the entire certificate chain, the intermediate certificate, or the end-entity (leaf) certificate. If you do, you run a high risk of breaking your integration as Stripe updates certificates for our systems every few months, including the intermediate CA certificates.

Our root certificates might also change in the future, both routinely and on an emergency basis. For routine changes to the list of root certificates, Stripe gives seven days notice through the [API announce mailing list](https://groups.google.com/a/lists.stripe.com/g/api-announce) before we roll out the change. You **must** make sure that all your clients that connect to Stripe APIs, including mobile applications, can handle this certificate list changing with seven days notice. Emergency rotations might have a shorter interval between notification and change.

### Root certificates for Stripe domains

- **DigiCert TLS ECC P384 Root G5**

  - Serial number: `09:e0:93:65:ac:f7:d9:c8:b9:3e:1c:0b:04:2a:2e:f3`
  - SHA-1 fingerprint: `17:f3:de:5e:9f:0f:19:e9:8e:f6:1f:32:26:6e:20:c4:07:ae:30:ee`
  - SHA-256 fingerprint: `01:8e:13:f0:77:25:32:cf:80:9b:d1:b1:72:81:86:72:83:fc:48:c6:e1:3b:e9:c6:98:12:85:4a:49:0c:1b:05`

- **DigiCert TLS RSA4096 Root G5**

  - Serial number: `08:f9:b4:78:a8:fa:7e:da:6a:33:37:89:de:7c:cf:8a`
  - SHA-1 fingerprint: `a7:88:49:dc:5d:7c:75:8c:8c:de:39:98:56:b3:aa:d0:b2:a5:71:35`
  - SHA-256 fingerprint: `37:1a:00:dc:05:33:b3:72:1a:7e:eb:40:e8:41:9e:70:79:9d:2b:0a:0f:2c:1d:80:69:31:65:f7:ce:c4:ad:75`

- **DigiCert Assured ID Root G2**

  - Serial number: `0b:93:1c:3a:d6:39:67:ea:67:23:bf:c3:af:9a:f4:4b`
  - SHA-1 fingerprint: `a1:4b:48:d9:43:ee:0a:0e:40:90:4f:3c:e0:a4:c0:91:93:51:5d:3f`
  - SHA-256 fingerprint: `7d:05:eb:b6:82:33:9f:8c:94:51:ee:09:4e:eb:fe:fa:79:53:a1:14:ed:b2:f4:49:49:45:2f:ab:7d:2f:c1:85`

- **DigiCert Global Root G2**

  - Serial number: `03:3a:f1:e6:a7:11:a9:a0:bb:28:64:b1:1d:09:fa:e5`
  - SHA-1 fingerprint: `df:3c:24:f9:bf:d6:66:76:1b:26:80:73:fe:06:d1:cc:8d:4f:82:a4`
  - SHA-256 fingerprint: `cb:3c:cb:b7:60:31:e5:e0:13:8f:8d:d3:9a:23:f9:de:47:ff:c3:5e:43:c1:14:4c:ea:27:d4:6a:5a:b1:cb:5f`

- **DigiCert Global Root G3**

  - Serial number: `05:55:56:bc:f2:5e:a4:35:35:c3:a4:0f:d5:ab:45:72`
  - SHA-1 fingerprint: `7e:04:de:89:6a:3e:66:6d:00:e6:87:d3:3f:fa:d9:3b:e8:3d:34:9e`
  - SHA-256 fingerprint: `31:ad:66:48:f8:10:41:38:c7:38:f3:9e:a4:32:01:33:39:3e:3a:18:cc:02:29:6e:f9:7c:2a:c9:ef:67:31:d0`

- **DigiCert High Assurance EV Root CA**

  - Serial number: `02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77`
  - SHA-1 fingerprint: `5f:b7:ee:06:33:e2:59:db:ad:0c:4c:9a:e6:d3:8f:1a:61:c7:dc:25`
  - SHA-256 fingerprint: `74:31:e5:f4:c3:c1:ce:46:90:77:4f:0b:61:e0:54:40:88:3b:a9:a0:1e:d0:0b:a6:ab:d7:80:6e:d3:b1:18:cf`

- **GlobalSign Root R46**

  - Serial number: `11:d2:bb:b9:d7:23:18:9e:40:5f:0a:9d:2d:d0:df:25:67:d1`
  - SHA-1 fingerprint: `53:a2:b0:4b:ca:6b:d6:45:e6:39:8a:8e:c4:0d:d2:bf:77:c3:a2:90`
  - SHA-256 fingerprint: `4f:a3:12:6d:8d:3a:11:d1:c4:85:5a:4f:80:7c:ba:d6:cf:91:9d:3a:5a:88:b0:3b:ea:2c:63:72:d9:3c:40:c9`

- **GlobalSign Root E46**

  - Serial number: `11:d2:bb:ba:33:6e:d4:bc:e6:24:68:c5:0d:84:1d:98:e8:43`
  - SHA-1 fingerprint: `39:b4:6c:d5:fe:80:06:eb:e2:2f:4a:bb:08:33:a0:af:db:b9:dd:84`
  - SHA-256 fingerprint: `cb:b9:c4:4d:84:b8:04:3e:10:50:ea:31:a6:9f:51:49:55:d7:bf:d2:e2:c6:b4:93:01:01:9a:d6:1d:9f:50:58`

- **Let’s Encrypt ISRG Root X1**

  - Serial number: `82:10:cf:b0:d2:40:e3:59:44:63:e0:bb:63:82:8b:00`
  - SHA-1 fingerprint: `ca:bd:2a:79:a1:07:6a:31:f2:1d:25:36:35:cb:03:9d:43:29:a5:e8`
  - SHA-256 fingerprint: `96:bc:ec:06:26:49:76:f3:74:60:77:9a:cf:28:c5:a7:cf:e8:a3:c0:aa:e1:1a:8f:fc:ee:05:c0:bd:df:08:c6`

- **Let’s Encrypt ISRG Root X2**

  - Serial number: `41:d2:9d:d1:72:ea:ee:a7:80:c1:2c:6c:e9:2f:87:52`
  - SHA-1 fingerprint: `bd:b1:b9:3c:d5:97:8d:45:c6:26:14:55:f8:db:95:c7:5a:d1:53:af`
  - SHA-256 fingerprint: `69:72:9b:8e:15:a8:6e:fc:17:7a:57:af:b7:17:1d:fc:64:ad:d2:8c:2f:ca:8c:f1:50:7e:34:45:3c:cb:14:70`

- **Sectigo Public Server Authentication Root R46**

  - Serial number: `75:8d:fd:8b:ae:7c:07:00:fa:a9:25:a7:e1:c7:ad:14`
  - SHA-1 fingerprint: `ad:98:f9:f3:e4:7d:75:3b:65:d4:82:b3:a4:52:17:bb:6e:f5:e4:38`
  - SHA-256 fingerprint: `7b:b6:47:a6:2a:ee:ac:88:bf:25:7a:a5:22:d0:1f:fe:a3:95:e0:ab:45:c7:3f:93:f6:56:54:ec:38:f2:5a:06`

- **Sectigo Public Server Authentication Root E46**

  - Serial number: `42:f2:cc:da:1b:69:37:44:5f:15:fe:75:28:10:b8:f4`
  - SHA-1 fingerprint: `ec:8a:39:6c:40:f0:2e:bc:42:75:d4:9f:ab:1c:1a:5b:67:be:d2:9a`
  - SHA-256 fingerprint: `c9:0f:26:f0:fb:1b:40:18:b2:22:27:51:9b:5c:a2:b5:3e:2c:a5:b3:be:5c:f1:8e:fe:1b:ef:47:38:0c:53:83`

You can verify and download these root CA certificates from [DigiCert](https://www.digicert.com/kb/digicert-root-certificates.htm), [GlobalSign](https://support.globalsign.com/ca-certificates/root-certificates/globalsign-root-certificates), [Let’s Encrypt](https://letsencrypt.org/certificates/), and [Sectigo](https://www.sectigo.com/knowledge-base/detail/Access-New-Sectigo-Certificate-Chain).