A Brief History of TLS Certificates at Shopify - Shopify

What this post added

This post details Shopify's journey in automating TLS certificate provisioning and management. It covers the initial manual provisioning for Shopify Plus, the development of the 'Notary System' for automated provisioning via API calls to certificate authorities, the scaling of this system using OpenResty and Lua for dynamic certificate loading from a database with LRU caching, and the resolution of mixed content warnings. It also discusses the adoption of Let's Encrypt and the subsequent migration to a cloud provider, including the decision to continue using the Notary system for both edge networks for synchronization simplification. Finally, it mentions the contribution of Lua middleware to the ingress-nginx Kubernetes project.