Skip to main content

APPLE PAY · MERCHANT IDENTITY

Merchant Identity certificates

The MI certificate authenticates your server to Apple during web merchant validation. It is not the PP certificate and does not decrypt payment tokens.

What you need

  • The correct Apple Developer team and Merchant ID, with Account Holder or Admin access for the portal procedure.
  • An RSA 2048-bit key pair and CSR for MI. Do not reuse a PP ECC CSR.
  • A backend or provider endpoint that performs merchant validation, plus a separately verified web domain.

Keep the private key on the server or in the responsible provider's secret store. Never ship it to browser code, a mobile app, a repository or a support ticket.

Create and install

  1. In Apple Developer → Certificates, Identifiers & Profiles → Identifiers → Merchant IDs, select the intended merchant.
  2. Under Apple Pay Merchant Identity Certificate, choose Create Certificate and upload the RSA CSR.
  3. Download the .cer and install it with the matching private key in the merchant-validation service.
  4. Check that the service uses this identity for the intended Merchant ID and website hostname. Test a fresh merchant-validation request from that consumer.

Replace without interrupting validation

MI certificates expire after 25 months. Start renewal at least 30 days ahead. Apple supports up to three active identity certificates, so you can create and test the replacement before revoking the old one.

  1. Create a new key, CSR and certificate; install the pair on every relevant consumer.
  2. Switch the merchant-validation service to the new identity and confirm fresh validation succeeds.
  3. After all consumers are confirmed, revoke the old identity in Apple Developer and remove the retired pair from the consumers.

Revocation immediately breaks requests still using the old identity. This overlap procedure is different from irreversible PP activation.

Common failures

  • Wrong CSR algorithm: MI requires RSA 2048-bit, including outside China mainland.
  • TLS or identity error: check expiry, revocation, the certificate/key pair and which identity the server actually loaded.
  • Merchant validation rejected: check Merchant ID, registered hostname and domain verification separately. A valid MI certificate alone is not enough.

Apple references

Configure Apple Pay on the web · Updating Apple Pay certificates (TN3206)

c3209c7