Looks like Shopify's servers don't handle well TLS v1.2; TLS v1.1 must be used in order to retrieve the access_token correctly without bypassing certificate validation.
We should update the library so that TLS v1.1 is used everywhere, and people don't have to figure it out by themselves.