register.apple.com

Certificate Type | Algorithm | Key Size

Apple Pay Payment Processing | ECC | 256-bit

Apple Pay Merchant Identity | RSA | 2048

👉 You need BOTH certificates for Apple Pay:

• Merchant Identity (RSA) → merchant session validation
• Payment Processing (ECC) → decrypt & process payments

Run this on any Linux server, WSL, Docker, or Windows (with OpenSSL installed):

openssl genrsa -out merchant_id_private.key 2048

✔ This file is VERY IMPORTANT
✔ Do not lose it
✔ Never upload it to Apple
✔ Store it securely (e.g. encrypted storage / secrets manager)

Now generate the CSR using that private key:

openssl req -new -key merchant_id_private.key -out merchant_id.csr

You’ll be prompted for details.
Use this guidance 👇

Country Name (2 letter code) [AU]: AU
State or Province Name: New South Wales
Locality Name: Sydney
Organization Name: Your Company Pty Ltd ← must match Apple account
Organizational Unit Name: IT
Common Name: Apple Pay Merchant
Email Address: admin@yourdomain.com

• Organization Name must match what’s in your Apple Developer account
• Common Name can be anything descriptive
• Email is optional but recommended

After this, you’ll have:

merchant_id_private.key ← keep secret
merchant_id.csr ← upload to Apple

1. Go to Apple Developer → Certificates
2. Choose the certificate type you’re creating:
   • Apple Pay Payment Processing Certificate
   • or Apple Pay Merchant Identity Certificate
3. Upload merchant_id.csr
4. Download the generated .cer file

Apple gives you a .cer file — OpenSSL usually want .pem.

Convert it:

openssl x509 -inform der -in merchant_id.cer -out merchant_id.pem

openssl ecparam -name prime256v1 -genkey -noout -out apple_pay_ecc_private.key

✔ This creates an ECC P-256 key
✔ This is exactly what Apple expects

openssl req -new -key apple_pay_ecc_private.key -out apple_pay_ecc.csr

Use the same org details as before:

Country Name (2 letter code): AU
State or Province Name: New South Wales
Locality Name: Sydney
Organization Name: Your Company Pty Ltd ← must match Apple account
Organizational Unit Name: IT
Common Name: Apple Pay Payment Processing
Email Address: admin@yourdomain.com

Now you have:

apple_pay_ecc_private.key ← KEEP SECRET
apple_pay_ecc.csr ← UPLOAD TO APPLE

In Apple Developer Portal:

1. Go to Certificates
2. Click +
3. Select:
   👉 Apple Pay Payment Processing Certificate
4. Upload:
   👉 apple_pay_ecc.csr

After Apple issues the cert:

openssl x509 -inform der -in apple_pay_payment.cer -out apple_pay_payment.pem

Keep files like this:

apple_pay_ecc_private.key
apple_pay_payment.pem

🔒 Permissions:

chmod 600 apple_pay_ecc_private.key

Used when calling Apple’s merchant validation URL (apple-pay-gateway.apple.com)

Used when your payment provider (Stripe/Adyen/etc.) decrypts Apple Pay tokens