A Brief History of TLS Certificates at Shopify - Shopify

From Manual CERTS to a Fully Automated TLS Pipeline

Shopify’s path toward full TLS coverage began in earnest in 2014, when only shop administration and checkout traffic were encrypted. Storefronts were served over plain HTTP, and the handful of certificates that did exist—covering *.myshopify.com and a single domain for checkout.shopify.com—were renewed by hand. The Operations team handled every renewal, and each new merchant domain meant a manual update to the certificate’s Subject Alternative Name (SAN) list.

The complexity grew with the launch of Shopify Plus in early 2014. One of the platform’s first features was encrypted storefronts, which required provisioning certificates for every new merchant domain. This was complicated by the certificate authority’s cap on domains per certificate and by the fact that many users still ran Internet Explorer on Windows XP, which lacked support for the Server Name Indication (SNI) extension. As a result, each new batch of domains required a fresh certificate and a dedicated IP address.

The manual approach had obvious drawbacks. Certificate updates were labor-intensive, IP addresses were consumed rapidly, and grouping unrelated shops’ domains on a single certificate was far from ideal. The process worked while merchant count was low but quickly proved unsustainable. Shopify turned to its Hack Days to prototype an automated system, and in May 2015 the project received full staffing. The result was an internal system called the Notary.

How the Notary Provisions and Serves Certificates

Notary was built to handle the entire certificate lifecycle automatically. When a merchant adds a domain, Notary sends an API request to the certificate authority. This includes the order, domain ownership verification, and retrieval of the certificate/private key pair. Renewals follow the same fully automated path.

Although grouping a merchant’s domains onto a single certificate would be logical, Notary keeps things simple: each domain gets its own certificate and unique private key. These are stored in a relational database, which load balancers query when terminating TLS connections.

Serving certificates at scale presented its own challenge. Shopify ran nginx load balancers in its data centers, and simply writing certificates to disk and reloading nginx on every change wasn’t viable. The team instead leaned on OpenResty’s Lua modules. Using the ssl_certificate_by_lua module, nginx could fetch the correct certificate dynamically during the TLS handshake. The certificate and private key were retrieved from the database in a single SQL query, with an in-memory LRU cache reducing handshake latency for frequently visited domains.

Overcoming Mixed Content and Moving to Let’s Encrypt

Encrypting storefronts introduced a new problem: merchant themes often referenced images and assets by their HTTP URLs. Serving those resources over an HTTPS page would trigger mixed content warnings in browsers. To address this, Shopify processed every shop’s theme and rewrote asset references from HTTP to HTTPS. With that hurdle cleared, all Shopify stores were served over encrypted connections starting in February 2016.

Shortly after Notary went into production, Let’s Encrypt launched in April 2016. Shopify, already a sponsor of the non-profit certificate authority, soon migrated most of its certificate provisioning away from the paid authority. Only Extended Validation (EV) certificates and other special cases continued to use the old provider.

The Cloud Migration and What Stayed Behind

In June 2019, Shopify moved its network edge from its own data center to a cloud provider. The large number of required certificates narrowed the viable vendor list significantly. Two options emerged: use the cloud provider’s managed certificate service or continue uploading Notary-provisioned Let’s Encrypt certificates. The initial migration went with the provider’s managed certificates, which offered a maintenance-free setup: no storage concerns and automatic renewals. The backfill for more than 1 million merchants’ certificates took several weeks, and merchants had to update their Domain Name System (DNS) Certification Authority Authorization (CAA) records during the transition.

After the first migration proved successful, Shopify revisited the strategy. Because the company maintains an alternate edge network for contingency, Notary remained operational. Running two systems meant two sets of certificates had to stay synchronized. To simplify operations, Shopify now provisions certificates through Notary for both edge networks, uploading them to the cloud provider as needed rather than relying on the provider’s own certificates.

Beyond merchant storefronts, some of the Lua middleware developed for this system—including the dynamic TLS certificate loading code—has been contributed to the open source ingress-nginx Kubernetes project. What started as a handful of manually managed certificates is now an automated pipeline serving more than 1 million businesses.