This article provides the full certification chain for each Zuora environment. See Inbound and Outbound IP Addresses for a list of addresses and for high-level steps on how to test connectivity.
Zuora recommends that you do not pin the certificates provided in this article. If you pin the certificates, the certificates will be associated with Zuora's hostnames. You must then update your trust store to include a new certificate whenever Zuora rotates a hostname's certificate. If you do not update your trust store, your connection to Zuora will become insecure.
See Pinning Cheat Sheet for more information about certificate pinning.
If you choose to pin the certificates, you should subscribe to updates at Zuora Status so that you receive alerts related to certificate changes. You should also monitor this article for the latest information about the certificates.
While Zuora attempts to give sufficient notice of planned certificate changes, Zuora may need to change a certificate at short notice in an emergency. Zuora reserves the right to change the certificates as necessary, as circumstances arise.
US Data Center Tenants
Download the certificate chain for US Production hostnames:
API Sandbox Environment
Download the certificate chain for US API Sandbox hostnames:
Performance Test Environment
Download the certificate chain for