Skip to content
  • There are no suggestions because the search field is empty.

Precoro API: SSL Certificate FAQ

Answers to the questions we get most often about Precoro's API certificate—what it is, when it renews, and what to set up on your side so a renewal doesn't break your integration.

TABLE OF CONTENTS

What Certificate Does Precoro Use?

Precoro uses a standard Let's Encrypt certificate that chains to the ISRG Root X1 root certificate. No custom or Precoro-specific certificate configuration is used.

The intermediate certificate you see can be RSA (R-series) or ECDSA (E-series), depending on the certificate's key type. Both are valid.

💡 Please note: The exact intermediate number (R10, R12, etc.) rotates by design every time the certificate is reissued. Don't hardcode a specific intermediate certificate, trust the chain up to the root instead.

When Does the Certificate Renew?

The certificate's current validity period is 90 days. That's a Let's Encrypt standard, not a Precoro choice—we used to have 1-year certificates, but the provider discontinued that option.

The certificate auto-renews roughly 30 days before it expires, at no fixed date or time.

The exact moment isn't something we control or know ahead of time either, so we can't give advance notice or a maintenance schedule for it. A new certificate can’t be provided in advance, because it’s generated only when the renewal occurs.

The setup described below is designed to handle these automatic renewals without requiring advance notice or changes on your side.

💡 Please note: The intermediate certificate rotates with each renewal, following the same short-lived issuance as the leaf certificate itself. The root has changed once before (a 2024 migration off an older Cloudflare-managed chain onto the current Let's Encrypt one) but is otherwise expected to stay stable.

Trust the standard public CA chain instead of a specific hardcoded certificate. This ensures both intermediate and root certificate changes are handled automatically.

Is the Certificate the Same Across Environments?

Your demo, live, and sandbox accounts on precoro.com share the same domain and the same certificate.

precoro.com and precoro.us run on separate servers and use independent certificates, each with its own renewal schedule. If your integration connects to only one of these domains, certificate changes on the other domain don’t affect your setup.

There's no fixed IP to hardcode. Point your integration at the hostname (api.precoro.com or api.precoro.us) since the underlying IP can change. See Using API in Precoro for how to set up your API connection.

What Should I Set Up on My Side?

Since certificate renewals don’t follow a fixed schedule, the best approach is to use an automated setup instead of relying on manual updates. That means:

  • Run an automated daily check on the certificate's validity and expiry.
  • If your system pins a specific certificate instead of validating against the CA chain, make sure that trust updates automatically when a check finds a new certificate.
  • Trust ISRG Root X1, validated against the standard public chain rather than a single pinned certificate.

This is what we recommend to every client managing certificates manually (most often on SAP or other enterprise setups)—it isn't specific to your integration.

Common Errors

  • Peer Certificate rejected by ChainVerifier (or a similar chain-of-trust error)
    Your system doesn't trust the current root yet. Re-import and trust ISRG Root X1 in your keystore to resolve this.

  • Integration breaks with no changes on your side
    Check whether the timing lines up with a renewal (see Renewal Schedule). If it does, this is expected behavior from an automatic renewal, not an outage. Update your trusted chain to match.

If you're seeing something not covered here, send us the exact error message, and we're happy to help!

Certificate configuration on your system must be managed on your side. Precoro cannot update or configure these settings remotely.

How Do I Check the Certificate Myself?

Check the current certificate and its expiry date anytime with SSL Labs. Point it at api.precoro.com (or api.precoro.us for that environment).

Precoro doesn't provide certificate files for manual installation, and there's no notification list for renewals. This article is the reference to check instead.