Skip to main content

APPLE PAY · PAYMENT PROCESSING

Payment Processing certificates

The PP certificate encrypts Apple Pay payment data. Its matching private key belongs with the party that decrypts it: your backend or your payment service provider (PSP).

Before creating a certificate

  • Confirm the Apple Developer team, Merchant ID and payment environment. Apple lists Account Holder or Admin as the required role for portal setup.
  • Decide who decrypts payments. If it is your PSP, obtain its CSR and follow its installation procedure; do not generate a replacement key on an unrelated machine.
  • Use a 256-bit ECC key for payment processing outside China mainland, or RSA 2048-bit for China mainland. The MI certificate uses a different CSR requirement.

Create and install

  1. In Apple Developer → Certificates, Identifiers & Profiles → Identifiers, select Merchant IDs and the intended merchant.
  2. Under Apple Pay Payment Processing Certificate, choose Create Certificate and upload the decrypting party's CSR. Resolve any account agreement notice first.
  3. Download the signed .cer. Install it with its matching private key in the backend or PSP that will process payments.
  4. Confirm the certificate, key and merchant match before activation. The downloaded certificate does not contain or recover the private key.

Activate a replacement

PP certificates expire after 25 months. Apple recommends starting renewal at least 30 days before expiry, leaving time for PSP coordination and testing.

Activation is immediate and irreversible. Only one PP certificate is active at a time. Activating the replacement invalidates the previous certificate; you cannot reactivate it as a rollback.

Prepare the decrypting consumer first, then activate in the merchant's Payment Processing section. During propagation, tokens may still reference the previous public key. If you handle decryption, select the private key using the token header's publicKeyHash and retain the old key until those tokens stop arriving. If your PSP handles decryption, it must manage this transition.

Common failures

  • CSR rejected: check the region-specific key algorithm and that you are creating PP, not MI.
  • Payments fail after activation: verify the consumer has the new certificate and matching key; ask the PSP to confirm readiness and token decryption.
  • Wrong expiry or merchant in inventory: compare the actual certificate with Apple's record before making another change.

Use the rotation and validation checklist to record scope, handoff and consumer evidence.

Apple references

Configure Apple Pay · Updating Apple Pay certificates (TN3206)

c3209c7