Safaricom discontinues M-PESA Certificate Installation
It is a great relief for African and especially Kenyan e-commerce website and application developers as Safaricom discontinues the need for installation of an M-PESA digital certificate on their computers as a requirement to access the M-PESA organization portal.
Safaricom PLC is a tech giant and the leading telecommunications services provider in Kenya, and one of the most profitable companies in the East and Central Africa region.
Among the many Safaricom products and services is M-PESA.
M-Pesa is the most successful electronic mobile money service and fintech platform in Africa, that allows people to store, send and receive money on their mobile phones.
It was launched in Kenya in 2007 and has since then expanded to other countries such as Tanzania, Mozambique, DRC, Lesotho, Ghana, Egypt, Afghanistan, South Africa, and Ethiopia.
M-Pesa users can securely and easily transfer cash from their phones to other users, shop for products and services with M-Pesa payment, or withdraw from an agent (typically in a corner shop).
Due to its safety and convenience, M-PESA has grown to become the most popular and de facto way of making payments across Africa, with over 49.7 million customers and 200,000 businesses.
All the major E-commerce platforms have it integrated as a way of receiving payments for online sales. Every other day, businesses are moving online and automating their sales process with M-Pesa payments.
In the integration process for online payments via M-Pesa, two portals are involved: the M-Pesa organization portal (also known as the G2 portal, for business owners), and the Daraja portal (for developers).
The business owners(Lipa na Mpesa account owners) are required to apply from Safaricom, the creation of an administrator account for their shortcodes (Paybill number or the Till number) before they can be integrated for online payments.
They are then required to log in to the G2 portal and create an account for the API user whose details are to be used by the developer in the Go-Live process of the Safaricom Daraja portal during the integration and also within the application/website for the various M-Pesa APIs.
M-PESA organization portal was certificate-based and required users to have an M-PESA digital certificate installed on their computer(s) before accessing it, for it to identify them as a valid entity.
Whenever the users had to access the portal from a different computer, they were required to install a separate M-Pesa digital certificate on that PC.
Trying to access the portal without the certificate installed resulted in a connection error as shown below, but could look a bit different depending on which browser you tried to access it with.
This portal was only accessible on Internet Explorer, Safari, and Google Chrome browsers and ONLY on Windows operating system.
Why M-Pesa certificate sucked
Below are some of the challenges/disadvantages that the M-Pesa certificate introduced:
Unnecessary delays in integrations. - It usually took 24-48hrs for the M-Pesa team to issue a certificate thus causing delays to the integration process.
Users were forced to use the Internet Explorer browser. - It's not a secret, Internet explorer sucks and people hate it. Being the only browser that supports certificates installation, users had no otherwise but to use it.
Installation was very technical. - The certificate application and installation procedure were complex and sometimes confusing for an average computer user.
A lot of errors during installation. - As if forcing people to use explorer and following a long technical procedure was not painful enough, the installation was also characterized with lots of known errors, which would traumatize even the tech-survey developers.
The requirement to use Windows OS. - Most developers prefer using Linux distributions. Since the certificate had to be installed on Internet explorer, only Windows OS was supported. Linux devs had to result in acquiring a separate Windows PC for M-Pesa integration purposes or had to keep using other people's PCs.
The great announcement: Discontinuation of the M-PESA certificate
On Tuesday 28th September 2021, Safaricom announced through its M-Pesa business email address (M-PESABusiness@safaricom.co.ke) to the partners/developers, the discontinuation of M-Pesa certificate.
It was titled: "Discontinuation of M-PESA Certificate Installation".
The email stated that the need to install a certificate in order to access the M-Pesa portal was to be discontinued from 30th September 2021.
This was to be replaced with a 6-digit One Time Password (OTP), for each user login that has been in use and confirmed to provide additional security over the user’s password by ensuring that only authorized users can log in
This decision was made to retire the Internet Explorer which is coming to the end of its life and is the only browser that supports certificates.
Currently, no new certificates will be issued. The expired ones will as well not be renewed.
From 30th September 2021, users are now able to access the M-Pesa organization portal without having a certificate installed on their computers.
This came as a relief to many as they had been complaining about the requirement, its complexity, and endless troubleshooting during M-Pesa certificate installation.
This came just a few months after Safaricom made a complete revamp of their developer (known as the Daraja) portal.
What discontinuation of M-Pesa certificates meant to developers
It quickened the integration process. - The developers no longer have to waste the 24 - 48hrs they had to waste earlier when applying for the certificate, waiting for it to get issued, and installing it.
The developers can access the M-Pesa portal on any browser of their choice.
The developers can access the portal from any operating system (eg. Windows, Linux, Mac, etc).
The developers are able to access the portal from different devices. This brings in flexibility as one is no longer limited to access it from a specific device that has the certificate installed.
