I am currently working on integrating a Payment Method with Shopify that requires me to validate their client requests using mTLS.
Payment apps must utilize mTLS for processing all requests where they act as the server and Shopify as the client. This is especially important when Shopify initiates sessions with payment apps. In such cases, Shopify uses its own client certificate, and payment apps must use the provided self-signed CA to validate that certificate. By implementing mTLS in these situations, payment apps can ensure that requests are initiated by Shopify and that the communication between Shopify and the payment app is secure.
In the past, I have used ngrok tunnels for various integrations with Shopify, but since they were not payment applications, mTLS was not required by Shopify, so I had no issues using the tunnels.
Now that I need to validate the client certificate on the server:
https
.createServer(
{
requestCert: true,
rejectUnauthorized: true,
ca: fs.readFileSync(path.join(__dirname, 'security', 'ca.pem')),
},
app
)
.listen(APP_PORT, () => console.log(`Server listening at: ${APP_URL}`));
'ca' in the code above refers to the certificate provided by Shopify in the documentation:
When trying to access my ngrok URL, I encounter the following message:
ngrok gateway error
The server returned an invalid or incomplete HTTP response.
ERR_NGROK_3004
After reviewing the ngrok documentation, I discovered that TLS tunnels can be used as well.
My initial question is: Will switching to a TLS tunnel prevent this error from occurring?
Furthermore, Shopify also requires:
The payment app must provide a certificate that Shopify will validate. This certificate should be a Trusted CA Signed SSL Certificate, not Shopify's self-signed CA.
My second question is: Will hosting the app on a server with an HTTPS certified URL fulfill this requirement? And is it acceptable to use a locally generated certificate while developing the app, for example with openSSL?
I seek your guidance as I do not have a paid ngrok account to access mTLS tunnels at this time.
Thank you for your assistance.
I am using Node + Express for the server.
Shopify Documentation: