# DigiCert Root Certificates
source: https://developer.mastercard.com/ethoca-alerts-for-merchants/documentation/api-basics/digicert-root-certificates/index.md

Note: Our mTLS client certificates are issued by DigiCert. Customers validating these certificates must trust the DigiCert certificate chain.

## Certificate Authorities {#certificate-authorities}

**Root CA**

**DigiCert Assured ID Root G2**

Download: [DigiCert Assured ID Root G2](https://knowledge.digicert.com/general-information/digicert-trusted-root-authority-certificates#:~:text=expired%C2%A0%C2%A0%C2%A0revoked-,DigiCert%20Assured%20ID%20Root%20G2,-Download%20PEM%C2%A0%7C%C2%A0)

**Intermediate CA**

**DigiCert Assured ID Client CA G2**

Download: [DigiCert Assured ID Client CA G2](https://knowledge.digicert.com/general-information/digicert-trusted-root-authority-certificates#:~:text=DigiCert%20Assured%20ID%20CA%20G2)

## Certificate Validation {#certificate-validation}

Customers should:

* Trust the DigiCert Root and Intermediate CAs.
* Additional x509 Certificate DN filtering is optional

## Leaf Certificate DN details {#leaf-certificate-dn-details}

* MTF/Sandbox testing environment:

  * Ethoca Alerts West Europe (active) -
    * CN=mtf.alertscustomer.ethocaclient.apigw.azure.mastercard.com, O=MasterCard International Incorporated, L=O'Fallon, ST=Missouri, C=US
  * Ethoca Alerts North Europe (standby) -
    * CN=mtf.alertscustomer.ethocaclient.apigw.azure.mastercard.com, O=MasterCard International Incorporated, L=O'Fallon, ST=Missouri, C=US
* Production environment:

  * Ethoca Alerts West Europe (active) -
    * CN: prod.alertscustomer.ethocaclient.apigw.azure.mastercard.com Country (C): US State / Province (ST): Missouri Locality (L): O'Fallon
  * Ethoca Alerts North Europe (standby) -
    * CN: prod.alertscustomer.ethocaclient.apigw.azure.mastercard.com Country (C): US State / Province (ST): Missouri Locality (L): O'Fallon

## Source Public IPs {#source-public-ips}

* MTF/Sandbox testing environment:

  * Ethoca Alerts West Europe (active) - 52.143.0.177
  * Ethoca Alerts North Europe (standby) - 51.104.165.139
* Production environment:

  * Ethoca Alerts West Europe (active) - 52.143.0.177
  * Ethoca Alerts North Europe (standby) - 51.104.165.139

## Certificate Pinning {#certificate-pinning}

Certificate pinning is not supported. Do not pin:

* Certificate fingerprints/thumbprints
* Serial number
* CA Signature

## Regional Certificate Deployment {#regional-certificate-deployment}

As part of Mastercard's certificate resiliency strategy, we are implementing a regional certificate model. Separate client certificates will be sent from Mastercard's independent redundant regions. Root and Intermediate certificates will remain consistent across all regions. Leaf DN information will also remain consistent across all regions. Only the Leaf fingerprints/thumbprints , Serial number and CA signature will be different across regions. This applies to both MTF/Sandbox testing and production environments.