I'm developing the integration of a Payment Method to Shopify which asks me to validate their (as client) requests using mTLS.
Payments apps must implement mTLS to handle all* requests where they are acting as the server and Shopify as the client. This is the case when Shopify initiates sessions with payments apps. In those cases, Shopify uses it's own client certificate. Payments apps must use the self-signed CA provided below in order to validate that certificate. Using mTLS in these scenarios allows payments apps to verify that the client initiating the request is Shopify and that the traffic between Shopify and the payments app is trusted and secure.
I'd used ngrok tunnels in many other integrations with Shopify, but since they were not a payment application, Shopify didn't require mTLS, so I had no problems using the tunnels.
Now that I make the client certificate validation in the server:
https
.createServer(
{
requestCert: true,
rejectUnauthorized: true,
ca: fs.readFileSync(path.join(__dirname, 'security', 'ca.pem')),
},
app
)
.listen(APP_PORT, () => console.log(`Server listening at: ${APP_URL}`));
Where 'ca' point to the certificate that Shopify give me in the documentation:
When I try to access my ngrok url i get this message:
ngrok gateway error
The server returned an invalid or incomplete HTTP response.
ERR_NGROK_3004
Looking in the ngrok documentation, I found that it's possible to use TLS tunnels.
The first question is: If I use a TLS tunnel, I won't get that error anymore ?
On the other hand, Shopify also requires that:
The payments app also needs to provide a certificate that Shopify will validate. For this certificate, you need to use a Trusted CA Signed SSL Certificate, and not Shopify’s self-signed CA.
The second question is: When I put the app in a server with an HTTPS certificated URL, i understand that I will fulfill this requirement. But I would like to know if while Im locally developing the app, It's ok to use a certificate generated, for example with openSSL
The reason I ask for your help and don't try to use a mTLS tunnel is that you need a ngrok paid account to access that type of tunnel, which i don't have.
Thank you very much.
Im using using Node + Express for the server.
Shopify Documentation: https://shopify.dev/apps/payments/general-transaction-requirements
