Third-party certificate and CA changes for outbound integrations in Adobe Commerce on cloud infrastructure
When a payment, fraud, or integration provider changes its TLS certificate chain or rotates its root certificate authority (CA), it is important to understand how this change relates to Adobe Commerce on cloud infrastructure projects.
This article explains how Adobe Commerce on cloud infrastructure handles outbound HTTPS connections to third-party services and how to verify connectivity after a vendor CA change.
Description description
Environment
- Product: Adobe Commerce on cloud infrastructure All supported versions
- Instance: Outbound HTTPS integrations, including payment providers, fraud-prevention services, and other third-party APIs
Steps to reproduce
-
Log in to the affected Adobe Commerce environment through SSH.
-
Run the following command against the configured vendor endpoint:
code language-none curl -v https://VENDOR_ENDPOINT 2>&1 | grep -i "SSL certificate|SSL connection|subject|issuer" -
Review the command output for TLS certificate verification or handshake errors.
Cause
Existing SSL/TLS documentation focuses on certificates for Adobe Commerce storefront and Admin domains, such as Let’s Encrypt and certificate renewal. It does not explain that outbound PHP or application connections rely on the OS-managed CA bundle when third-party vendors rotate to a different publicly trusted root CA.
Resolution resolution
Use the following guidance to determine whether a third-party certificate or root CA change requires action.
-
Adobe Commerce Cloud outbound connections trust the OS-managed CA bundle.
-
When a payment or fraud vendor moves to another publicly trusted root CA, no action is normally required.
-
Customers can verify from SSH before opening a case:
code language-none curl -v https://<vendor-endpoint> -
If the TLS handshake fails or returns a certificate verification error, that confirms the CA bundle needs review or update; only then should a support ticket be opened.