Chargebee root and intermediate CA certificate updates

Upgrade and Testing Workflow

This document helps you verify, upgrade, and test your integration for compatibility with Chargebee’s upcoming certificate and cipher changes.

Use these steps to test compatibility, upgrade, and validate your integration:

1. Test Compatibility With Upcoming Certificates
2. Check Your Current SDK Version
3. Post-Upgrade Validation

1. Test Compatibility With Upcoming Certificates

Make a simple API call to a public Chargebee endpoint to check compatibility.

Use one of the following:

• Product Catalog 2.0: List Customers API – cURL example
• Product Catalog 1.0: List Customers API – cURL example

Use the following test site and API key instead of your Chargebee site and key:

• Replace {site} with ssl-validation-test.
• Replace {site_api_key} with test_abc.

Example request:

curl https://ssl-validation-test.chargebee.com/api/v2/customers \
  -G \
  -u test_abc: \
  --data-urlencode "first_name[is]=John" \
  --data-urlencode "last_name[is]=Doe" \
  --data-urlencode "email[is]=john@test.com"
  

Expected JSON response:

{
  "message": "Sorry, authentication failed. Invalid api key",
  "api_error_code": "api_authentication_failed",
  "error_code": "api_authentication_invalid_key",
  "error_msg": "Sorry, authentication failed. Invalid api key",
  "http_status_code": 401
}
  

A 401 Unauthorized response indicates that the TLS handshake was successful and your environment is compatible with the new certificates.

No further action is required; you can safely skip the remaining sections of this document.

If you encounter a certificate or SSL-related error instead, proceed to upgrade your SDK or trust store using the steps below.

Certificate error examples (not compatible)

• certificate verify failed (self signed certificate in certificate chain)
• [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain
• SSL certificate problem: self-signed certificate in certificate chain

2. Check Your Current SDK Version

We provide an updated minor version with full backward compatibility for SDKs that embed the CA bundle (Python, PHP v3, Ruby).

Example: If you’re on Ruby SDK v2.59.0, upgrade to v2.60.0.

Use the table below to identify your SDK, verify its current version, and determine the G2-supported version that includes the updated cacert.

We strongly recommend upgrading to the latest supported SDK version. Continuing to use End-of-Support (EOS) versions may expose you to security vulnerabilities.

If you can’t upgrade immediately, you can manually replace the cacert in your installed SDK, using the paths below:

Other SDKs and integration patterns

• If your integration uses a different SDK or manages its own keystore/trust store, manually import the DigiCert G2 root and all required intermediate certificates. You can also reference the bundled list here: ca-certs.crt.
• Steps vary by platform. Refer to your stack’s documentation to identify and update the trust store in use.

3. Post-Upgrade Validation

After updating your SDK or trust store, repeat the Test Compatibility step.

Expected result (handshake OK):

• Error: Sorry, authentication failed. The basic authentication header has invalid format.
HTTP Status Code: 401

This confirms your integration is compatible with the new certificate chain.

We recommend regression testing your key flows before promoting to higher environments.

Timelines

After you update cacert and validate your integration, you may deploy to production at your convenience.

Starting November 1, 2025, Chargebee will briefly switch certificates on our load balancers every weekend (Saturdays and Sundays) for 5 minutes to help you validate and detect issues.

The new certificates will be applied permanently beginning February 2026. Any unresolved compatibility issues after this date may cause API call failures or connection disruptions.

Please complete all required updates well in advance to avoid service interruptions.