Branded URLs are easy to implement unless SSL is required. We wanted to provide our customers with an easy solution that will work with our existing clicks solution, requiring minimum effort from them to implement, all while not changing our existing architecture and system. Our customers need branded URLs in order to maintain their brand equity, improved security practices, and increase click-through rates. In a world where becoming secure is mission-critical, HTTPS is a must. However, there really is no out of the box solution for apply HTTPS at scale, so we found ourselves having to build our own solution. In order to implement SSL for our customers, a complicated security process was required involving different groups within the organizations both on the client’s side, and within our own company. This talk will dive into how we solved this problem with Letsencrypt, Docker, Redis, Nginx, resty-Lua and and autossl module.

1. Free YourSSLf
And The Resty
Will Follow
Dana Borinski &
Eli Zilbershtein

2. 95%
Devices with
AppsFlyer’s SDK
90B+
Events/Day
AppsFlyer in Numbers
10K+
Servers
“AppsFlyer is the world's leading mobile attribution & marketing
analytics platform, helping app marketers around the world make
better decisions.”

3. OneLink Overview
Deep Linking
Deferred
Deep
Linking
New users are
sent to the right
app store first.
App Installed
App Not
Installed

4. Why Branded Links?
Strong Branding

5. Why Branded Links?
Strong Branding
https://mybooks.onelink.me/PCcG/2492c568

6. Why Branded Links?
Strong Branding
https://mybooks.onelink.me/PCcG/2492c568

7. Why Branded Links?
Strong Branding
https://mybooks.onelink.me/PCcG/2492c568

8. Why Branded Links?
Strong Branding
https://click.mybooks.com/PCcG/2492c568
https://mybooks.onelink.me/PCcG/2492c568

9. Why Branded Links?
Email Campaigns

10. Why Branded Links?
Email Campaigns
Branded Link =

11. Why Branded Links?
Email Campaigns
Non Branded Link =

12. Why Branded Links?
Email Campaigns
Non Branded Link =

13. Why HTTPS?
Why
HTTPS?

14. Why HTTPS?
Trust & Security

15. Why HTTPS?
Trust & Security
Privacy

16. Why HTTPS?
Trust & Security
Privacy
Search Ranking

17. Why HTTPS?
Trust & Security
Privacy
Search Ranking
Deep Links

18. OneLink Overview
Deep Linking
Deferred
Deep
Linking
New users are
sent to the right
app store first.
App Installed
App Not
Installed

19. 1. Enrollment
2. Validation
3. Deployment
4. Monitoring
5. Renewal
SSL Certificate Lifecycle
10K
customers

20. 1. Operation
2. Human intervention
3. Customer support
4. Non technical customers
5. Bureaucracy
Clearly this does not scale

21. What is Let’s encrypt?

22. This DOES
Scale!

23. The GlassGate

24. OneLink Clicks System
Clicks
System
S3 redis
kafka
ELB
aerospike

25. The GlassGate

26. Naive Implementation
Clicks
System
S3 redis
kafka
GlassGate
ELB
aerospike

27. Basic Implementation (still naive)
Clicks
System
Internal
ELB
S3 redis
kafka
aerospike
GlassGate
ELB

28. GlassGateGlassGate
Redundancy (still naive)
Clicks
System
Internal
ELB
S3 redis
kafka
aerospike
GlassGate
NLB
ELB

29. GlassGateGlassGate
Certificates storage
Clicks
System
Internal
ELB
S3 redis
kafka
GlassGate
NLB
ELB
redis
aerospike

30. GlassGateGlassGate
System Scaling (not naive)
Clicks
System
Internal
ELB
S3 redis
kafka
GlassGate
NLB
ELB
redis
aerospike

31. GlassGateGlassGate
DNS
GlassGate
NLB
ELB
redis
mybooks.com
mybooks.brandedlinks.com
*.brandedlinks.com

33. What about visibility?

35. All Good Right?

36. Almost...

37. GlassGateGlassGate
Evil robot (or bad configuration)
Clicks
System
Internal
ELB
S3 redis
kafka
GlassGate
NLB
ELB
redis
aerospike

38. GlassGateGlassGate
Evil robot (or bad configuration)
Clicks
System
Internal
ELB
S3 redis
kafka
GlassGate
NLB
ELB
redis
aerospike

39. ● Domain verification.
● Non valid domains caching.
● Central certificates storage.
● Certificates pre warm.
● Let’s Encrypt Staging Environment.
Lesson Learned

40. Thank you
eli.zilbershtein@appsflyer.com
dana.borinski@appsflyer.com

41. ● https://github.com/GUI/lua-resty-auto-ssl
● https://hub.docker.com/r/openresty/openresty/
● https://letsencrypt.org/docs/rate-limits/
● https://letsencrypt.org/docs/staging-environment/
Resources

42. ● 85,167,054 SSL certificates on the entire internet
(Source: BuiltWith)
● 84.2% of pages loaded in Chrome, on all platforms, are
over HTTPS (Source: Google’s Transparency Report)
● 70.8% of the unencrypted user traffic to Google comes
from mobile devices.
SSL usage