# Avoiding disruption from ongoing TLS certificate changes

The TLS industry is moving toward shorter certificate lifetimes and the retirement of certain multi-purpose roots. These changes may lead to more frequent certificate renewals and trust-chain updates over time.
Beginning **September 2, 2026**, Stripe is updating the intermediate certificates used by `api.stripe.com`. The root certificate is not changing.
## Our recommendation
Stripe strongly recommends against pinning any TLS certificate, including leaf, intermediate, or root certificates. Certificate pinning can cause unexpected outages when certificates are renewed, intermediate chains change, or trust stores are updated. Pinning leaf and intermediate certificates is especially fragile because they are expected to change more frequently.
Instead, use your operating system or language runtime's standard trust store and keep it current.
If your organization requires certificate pinning, pin only the root certificates listed in [Stripe's TLS certificate documentation](https://docs.stripe.com/tls-certificates#root-certificates-for-stripe-domains). Do not pin leaf or intermediate certificates.
## What you need to do
- If you don't pin certificates, no action is required.
- If you pin only root certificates, no action is required for this change.
- If you pin intermediate certificates, **remove** those pins as soon as possible.
- If you can't remove intermediate pins before September 2, temporarily add the new intermediate CAs (ICAs) alongside your existing ICA pins.
The new certificate chain is available at [`test-api.stripeqacl.com`](https://test-api.stripeqacl.com/) for testing.
## Common certificate errors
TLS certificate failures can appear as:
```text
SSL certificate problem: unable to get local issuer certificate
certificate verify failed
x509: certificate signed by unknown authority
PKIX path building failed
unable to verify the first certificate
TLS alert: unknown CA
cURL error 60
```
## Troubleshooting
If you encounter one of these errors:
1. Confirm that your operating system, language runtime, and CA trust store are current.
1. Check whether your integration pins Stripe leaf or intermediate certificates.
1. Remove leaf and intermediate certificate pins.
1. If root pinning is required, ensure that you trust all roots listed in Stripe's TLS certificate
   documentation.
You can use [`test-api.stripeqacl.com`](https://test-api.stripeqacl.com/) to test certificate compatibility for
connections to `api.stripe.com`.
## Contact us
If the error continues, contact [certificate-queries@stripe.com](mailto:certificate-queries@stripe.com)
and include:
- The complete error message.
- The Stripe domain you're connecting to.
- Your operating system and language runtime versions.
- Your CA bundle or trust-store version.
- If you use a Stripe SDK, please include the SDK name and version in your response.
- Whether you use certificate pinning or TLS inspection.