To help ensure the continued security and reliability of our API services, DHL will be updating the TLS certificate chains used by several API endpoints between 2 and 4 of November 2026.
For most customers, no action is required. However, if your applications use custom trust stores, certificate pinning, or explicitly trust specific Certificate Authorities (CAs), we recommend reviewing the information below and updating your configuration before the relevant migration date.
What Is Changing?
The CA certificate chain for the following hostnames will be updated:
| Hostname | Schedule Date |
|---|---|
| api.dhl.com | 2 Nov 2026 |
| api-eu.dhl.com | 2 Nov 2026 |
| utapi.api-eu.dhl.com | 3 Nov 2026 |
| apigateway.bluedart.com | 4 Nov 2026 |
| ondc.bluedart.com | 4 Nov 2026 |
Current CA Certificate Chain
- GlobalSign Root R3 (Serial: 04000000000121585308a2)
- DPDHL Global TLS CA - I5 (Serial: 77bd0ddf6384ffb1d14a3edd8383c869)
New CA Certificate Chain
- GlobalSign Root R46 (Serial: 11d2bbb9d723189e405f0a9d2dd0df2567d1)
- DHL Global TLS CA I7 (Serial: 008657dc5a414d2aac947ec5ed72f2d7b3)
Who Should Review This Change?
You may need to take action if your application:
- Uses a custom trust store or custom CA bundle
- Implements certificate pinning
- Explicitly trusts specific root or intermediate certificates
- Runs in an environment where trusted certificates are managed manually
- Uses legacy platforms or devices with restricted trust stores
If your application relies on standard operating system, browser, or Java trust stores, no action is typically required.
What Do I Need to Do?
If your environment uses custom certificate trust settings, please ensure that the following certificates are trusted before the migration date of the host(s) you use:
- GlobalSign Root R46 (Serial: 11d2bbb9d723189e405f0a9d2dd0df2567d1)
- DHL Global TLS CA I7 (Serial: 008657dc5a414d2aac947ec5ed72f2d7b3)
Taking this step in advance will help avoid TLS handshake failures or connectivity issues once the new certificate chain is activated.
Where Can I Download the CA Certificates?
The CA certificates are available from the following official sources:
- GlobalSign Certificate Repository - https://support.globalsign.com/ca-certificates/globalsign-root-certificates (Root)
- DHL Certificate Repository - https://keyserver.dhl.com/certificates (Root and Intermediate)
Recommended Next Steps
- Identify whether your applications connect to any of the affected endpoints.
- Check whether certificate pinning or custom trust stores are being used.
- Download and import the new CA certificates where required.
- Validate TLS connectivity in your test or non-production environments to DHL sandbox hostnames.
- api-sandbox.dhl.com
- utapi.api-sandbox.dhl.com
- apigateway-sandbox.bluedart.com
- ondc-sandbox.bluedart.com
- Complete any necessary updates before the applicable migration date.
Frequently Asked Questions
Are the API URLs changing?
No. The endpoints remain the same. Only the TLS certificate chain is changing.
Will there be any API functionality changes?
No. This update only affects the certificates used to secure TLS connections. No API functionality, payload formats, or URLs are changing.
What happens if I don't update my custom trust store?
Applications that trust only the current certificate chain may be unable to establish secure connections after the change, resulting in TLS validation or handshake errors.
Need Help?
If you have any questions about this change or need assistance validating your configuration, please contact your DHL support representative or raise a support ticket through the DHL Developer Portal Help Center