North America North America
Create a test account Support Login

SSL Cert Renewal

Legacy Bambora and Beanstream endpoints will be retired. Update to *.bam.shift4api.net by December 31, 2026, to avoid disruption. Please review the updated FAQs / Mapping documentation for details.

New endpoints (*.bam.shift4api.net)

The new Shift4 API endpoints under *.bam.shift4api.net use certificates issued by Let’s Encrypt.

What does this mean?

These endpoints present a chain that terminates at ISRG Root X2 (Let’s Encrypt / Internet Security Research Group ECDSA root).

What action is required?

  • Most modern browsers, operating systems, and language runtimes already trust ISRG Root X2 (or can build a path via the cross-sign from ISRG Root X1).
  • If you manually manage certificate trust stores (or pin certificates), ensure ISRG Root X2 is installed.
  • Download ISRG Root X2 (or the attached certificate)

Legacy endpoints (*.na.bambora.com and*.beanstream.com) — root certificate valid until 31 December 2026

The BIC platform transitioned to a new TLS certificate trust chain on 12 May 2026, in response to major browser and operating system vendors retiring legacy root CA certificates.

What does this mean?

Since 12 May 2026, the BIC platform has been using new TLS certificates signed by DigiCert, replacing the previous certificate chain issued by Sectigo and USERTrust.

This DigiCert root certificate (DigiCert TLS RSA4096 Root G5) applies only to the legacy BIC endpoints (*.na.bambora.com, *.beanstream.com, etc.). Those endpoints will be retired on 31 December 2026. After that date the DigiCert root will no longer be needed for BIC traffic.

What action is required?

  • Most browsers and operating systems require no action by default.
  • If you manually manage certificate trust stores and will continue using the legacy endpoints until the end of 2026, ensure DigiCert TLS RSA4096 Root G5 is installed.
  • Download DigiCert TLS RSA4096 Root G5
  • We strongly recommend migrating to the new *.bam.shift4api.net endpoints before 31 December 2026 so you do not need to maintain the temporary DigiCert root.

    Testing and availability

    What you need to know

    • This change is technical in nature. If you are unable to verify your integration, please consult your developer or software/web provider.
    • SSL/TLS best practice is to trust only the root certificate. Do not download or store server certificates.
    • If you manage your certificate trust store manually and take no action by the deadline, connections to the BIC platform may fail.

    If you have issues with the required changes, please reach out to our Customer Care team.