Full Certification Chain
This article provides the full certification chain for Zuora environments. See Inbound and Outbound IP Addresses for a list of addresses and for high-level steps on how to test connectivity.
Zuora recommends that you do not pin the certificates provided in this article. If you pin the certificates, the certificates will be associated with Zuora's hostnames. You must then update your trust store to include a new certificate whenever Zuora rotates a hostname's certificate. If you do not update your trust store, your connection to Zuora will become insecure.
See Pinning Cheat Sheet for more information about certificate pinning.
If you choose to pin the certificates, you should subscribe to updates at Zuora Status so that you receive alerts related to certificate changes. You should also monitor this article for the latest information about the certificates.
While Zuora attempts to give sufficient notice of planned certificate changes, Zuora may need to change a certificate at short notice in an emergency. Zuora reserves the right to change the certificates as necessary, as circumstances arise.
US Cloud Data Center 1 Tenants
This data center is the default data center for Zuora customers whose tenants are provisioned after September 2020. It is hosted completely in the cloud, with certificates issued by Amazon.
US Cloud Data Center 2 Tenants
The US Cloud Data Center 2 is maintained for use by customers who started using Zuora's services before September 2020.
Production Environment
Download the certificate chain for US Cloud 2 Production hostnames:
API Sandbox Environment
Download the certificate chain for US Cloud 2 API Sandbox hostnames:
Performance Test Environment
Download the certificate chain for rest.pt1.zuora.com:
Production Copy Environment
Download the certificate chain for US Cloud 2 Production Copy Environment hostnames:
EU Data Center Tenants
The EU Data Center is hosted completely in the cloud, with certificates issued by Amazon.