What to do

Required changes

In order to increase security and ensure the continuity of your connections with our APIs, your team must carry out the following changes:

• Update the certificate chain, adding the new Root CA and the new intermediate certificate to the application's truststore or keystore. During the transition period, we recommend also keeping the current chain, ensuring a safe migration with no impact to operations.
• Allow the new IP ranges in the firewalls of the consuming environments. This update is required to keep secure and continuous communication with our infrastructure, even if the URLs currently in use remain unchanged.
• Update the API URLs that will start using new connection addresses, ensuring that the API integrations keep operating normally after the infrastructure evolution.

Download the certificates

Action checklist

How to test?

After importing the new certificate chain into your truststore, we recommend validating TLS communication using the validation endpoints provided by Itaú.

Test URL

Depending on the impacted address, use the corresponding validation URL:

  
https://secure.gateway.api.itau/sandbox/ca-validation
  
https://api.gateway.itau.com.br/sandbox/ca-validation
  
https://api-bin.gateway.itau.com.br/sandbox/ca-validation

Test using cURL

Before running the validation, generate an access token using your application credentials:

curl --request POST \
  --url https://sts.itau.com.br/api/oauth/token \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --cert <mTLS-certificate> \
  --key <mTLS-private-key> \
  --data grant_type=client_credentials \
  --data 'client_id=<client-id>' \
  --data 'client_secret=<client-secret>'

After obtaining the token and making sure the new certificate chain was imported correctly, run the call below to validate communication with the environment:

curl --request GET \
  --url <url-de-validacao-utilizada>' \
  --header 'Authorization: Bearer <token-gerado-anteriormente>' \
  --header 'x-itau-apikey: <client-id>' \
  --cert <mTLS-certificate.crt>' \
  --key <private-key.key>' \
  --header 'x-itau-correlationID: 123' \
  --header 'x-itau-flowID: 123'

Expected result

If the configuration is correct:

• The call to the validation endpoint will run successfully.
• There will be no errors related to certificate, truststore or SSL/TLS.
• The endpoint response will indicate that the certificate chain was correctly validated by the environment.

About the certificate update

To keep up with the evolution of the security standards adopted by the market, we will update the certificate chain used in the integrations with the Itaú APIs.

This change helps maintain the security, reliability and continuity of the connections used in services such as payments, collections, Pix, reconciliations and other transactional operations.

Migration deadline: by September 15th, 2026.

Why this change is happening now

Certificate validity periods are being reduced globally, following a decision by the CA/Browser Forum. The reduction will happen gradually:

• 200-day validity for certificates issued from March 15th 2026.
• 100-day validity for certificates issued from March 15th 2027.
• 47-day validity for certificates issued from March 15th 2029.

In line with this guideline, the new certificates used by Itaú on the API consumption addresses listed above will have a 200-day validity. To ensure the continuity of your connections, you will need to add the new digital certificate chain and adjust the connection addresses (DNS and IPs) used by your company by the dates set in the schedule.

Frequently asked questions

Support channels

Need help during the migration? Talk to the team responsible for your segment.