>> The issue with https is that it’s really bloody hard. How we handle it: we terminate all incoming connections at haproxy and negotiate ssl there. The haprox

>> The issue with https is that it’s really bloody hard. How we handle it: we terminate all incoming connections at haproxy and negotiate ssl there. The haproxy instance is packaged into a docker container that pulls the right certs from a private repo at build time. By building this container with different flags we can enable/disable ssl termination. The cert is a wild-card so we can drop this container anywhere in our stack and point dns at it and we get solid ssl termination. The certs themselves are obtained from godaddy, and all the prep that is required is to copy them to the correct repository. The haproxy containers cats them into the correct combined format at build time. This took substantially less than a morning to set up.