Skip to main content
Your organization manages its Apple account, certificate signing, and domain verification. WeGive installs validated certificates and manages the connection to VGS. Open Settings → Payments → Apple Pay to check certificate expiry dates, connection status, and verified domains. Keep the renewal email current and monitor Apple Developer notices as well.
Renew before expiration. Do not revoke an existing certificate until its replacement is installed and the transition is confirmed. Retaining an old certificate in WeGive cannot make an expired or revoked certificate valid in Apple.

​
Renew the Merchant Identity certificate

1

Create the renewal request in WeGive

In the Merchant Identity card, select Start renewal, then download the new certificate request. Use this new CSR for the renewal.
2

Have Apple sign the request

Open the same Merchant ID in Apple Developer. Create a new Apple Pay Merchant Identity Certificate using the new identity CSR, then download the signed .cer.
3

Upload and verify

Choose the signed certificate in WeGive’s Merchant Identity card and select Upload signed certificate. Confirm it becomes Active with the new expiry date. WeGive keeps the current identity selected until the replacement passes validation.

​
Renew the Payment Processing certificate

The installation order matters because the payment token must be encrypted for a key the VGS connection can use.
1

Create and sign the new processing request

Select Start renewal in WeGive’s Payment Processing card and download the CSR. In Apple Developer, use it to create a new Apple Pay Payment Processing Certificate under the same Merchant ID. Download the signed .cer.
2

Install the replacement in WeGive

Choose the new certificate in the Payment Processing card and select Upload signed certificate. Wait for Installed and Connection status: Ready. Keep the old certificate available during this transition.
3

Activate the replacement in Apple

Once installation is confirmed, complete Apple’s activation step for the replacement certificate. Follow Apple’s certificate update guidance.
4

Verify checkout

Complete an agreed test using the testing guide. Confirm the donation result for the intended environment before treating renewal as complete.
WeGive supports two valid processing certificates during the transition and updates the existing VGS connection. If another renewal is blocked because two valid processing certificates already exist, contact WeGive before removing either one. A rejected upload or failed installation does not complete renewal. Resolve the displayed error or contact WeGive; do not activate the new processing certificate in Apple while installation is incomplete.

​
Add or replace a donation domain

Renewal and domain updates do not automatically select VGS as your provider. Check activation and checkout settings after the work is complete.

​
Change providers or Merchant IDs

Coordinate these changes with WeGive before publishing new files or revoking certificates:
  • Switching Apple Pay between VGS, Stripe, and Braintree.
  • Changing the Merchant ID associated with the configuration.
  • Moving configuration between organization records.
  • Replacing credentials after a suspected compromise or urgent revocation.
Provider changes can also change the public domain-association file. Plan the file change, provider activation, and verification together so donors are not left with an incomplete setup.

​
Keep an ownership record

Keep this information with your team’s operating instructions: This record does not need private keys, Apple passwords, or payment data.

Full setup guide

Review the certificate and domain workflow.

Testing and troubleshooting

Verify the transition and diagnose incomplete setup.