---
title: "A Brief History of TLS Certificates at Shopify"
description: "Shopify’s TLS certificate infrastructure evolved from a handful of manually renewed certificates for administration and checkout traffic to an automated system supporting more than 1M merchants. The initial Shopify Plus implementation added domains to shared Subject Alternative Name (SAN) certificates, but manual provisioning, certificate-authority limits, extra IP requirements, and the inability to rely on SNI made the approach labor-intensive and error-prone. Notary automated certificate-authority API requests, domain verification, delivery, and renewals, storing one certificate and unique private key per domain in a relational database. OpenResty Lua middleware dynamically loaded certificates through ssl_certificate_by_lua, while an in-memory LRU cache reduced handshake latency; theme processing replaced HTTP asset references to prevent mixed-content warnings. After reaching all-merchant encrypted storefronts in February 2016, Shopify migrated much of its certificate use to Let’s Encrypt and later a cloud edge, ultimately returning to Notary-issued certificates uploaded to both edge networks to simplify synchronization."
---

# A Brief History of TLS Certificates at Shopify

[Shopify](https://yomu.fyi/company/shopify) · 2023-10-18 · May 14, 2020

**Type:** Explainer

## Summary

Shopify’s TLS certificate infrastructure evolved from a handful of manually renewed certificates for administration and checkout traffic to an automated system supporting more than 1M merchants. The initial Shopify Plus implementation added domains to shared Subject Alternative Name (SAN) certificates, but manual provisioning, certificate-authority limits, extra IP requirements, and the inability to rely on SNI made the approach labor-intensive and error-prone. Notary automated certificate-authority API requests, domain verification, delivery, and renewals, storing one certificate and unique private key per domain in a relational database. OpenResty Lua middleware dynamically loaded certificates through ssl\_certificate\_by\_lua, while an in-memory LRU cache reduced handshake latency; theme processing replaced HTTP asset references to prevent mixed-content warnings. After reaching all-merchant encrypted storefronts in February 2016, Shopify migrated much of its certificate use to Let’s Encrypt and later a cloud edge, ultimately returning to Notary-issued certificates uploaded to both edge networks to simplify synchronization.

## Context

Shopify needed to extend TLS encryption from administration and checkout traffic to storefronts for all merchants. Manual provisioning became labor-intensive and error-prone as Shopify Plus onboarded more domains, while certificate limits, additional IP requirements, and mixed-content warnings created further operational challenges.

## Approach / What changed

The Notary system automated certificate-authority API operations, domain verification, certificate delivery, and renewals. It stored per-domain certificates and private keys in a relational database, used OpenResty Lua and SNI to load certificates dynamically with an LRU cache, processed themes to replace HTTP asset references, and later adapted certificate delivery for cloud and alternate edge networks.

## Takeaways

- Notary provisions one certificate and unique private key per domain, even when multiple domains belong to the same shop, and stores them in a relational database accessible to load balancers.
- OpenResty’s ssl\_certificate\_by\_lua module dynamically retrieves certificates with a SQL query, while an in-memory Least Recently Used cache lowers TLS handshake latency for frequently accessed domains.
- Shopify initially used cloud-provider managed certificates, but returned to Notary-provisioned certificates for both edge networks because maintaining two certificate sets increased synchronization and operational work.

**Tags:** [nginx](https://yomu.fyi/topic/nginx), [TLS](https://yomu.fyi/topic/tls)

- Source: [Shopify](https://shopify.engineering/brief-history-tls-certificates-shopify)
- Source URL: https://shopify.engineering/brief-history-tls-certificates-shopify
- Ingested by Yomu: 2026-08-31T01:12:44.266Z

[Read original post](https://shopify.engineering/brief-history-tls-certificates-shopify)