A Brief History of TLS Certificates at Shopify - Shopify

This post details Shopify's journey from manually provisioning TLS certificates to a fully automated system. Key contributions include the development of the 'Notary System' for automated certificate provisioning via API calls to certificate authorities, handling domain ownership verification, and certificate/private key delivery. It also covers scaling certificate provisioning by dynamically loading TLS certificates from a database in Lua middleware via the `ssl_certificate_by_lua` module, using an in-memory LRU cache to reduce latency. The post also discusses solving mixed content warnings by processing shop themes to replace HTTP with HTTPS and the migration to Let's Encrypt. Finally, it details the move to a cloud provider, initially using managed certificates, and then adapting the Notary system to upload certificates to the cloud provider for both edge networks.