6 ms·

You can use CloudFlare with a custom domain in front of Github Pages. It works. I do this for https://github.com/leighmcculloch/5tweets.com https://github.com/l

You can use CloudFlare with a custom domain in front of Github Pages. It works. I do this for https://github.com/leighmcculloch/5tweets.com https://github.com/leighmcculloch/5tweets.com which you can see SSL'd at https://5tweets.com https://5tweets.com.

deleted 11y ago
[deleted]
rasz_pl 11y ago
and doesnt work in older browsers - free cloudflare cert is ECDHE
- crymer11 11y ago
  As some who cares both about accessibility on the web and security, what up-to-date browsers don't support ECDHE and what else would be reasonable to support as well?
  - rasz_pl 11y ago
    probably nothing up-to-date, hence I wrote older :) Opera 12.xx being one of the older browsers that works 99% of the time, except EVERY SINGLE page with Cloudflare cert What makes matters worse is CloudFlare lying about support level: https://support.cloudflare.com/hc/en-us/articles/203041594-What-browsers-work-with-CloudFlare-s-SSL-certificates- https://support.cloudflare.com/hc/en-us/articles/203041594-W... They claim Opera 8, 2005 browser supports ecdhe.
    - russell_h 11y ago
      At this point anyone using Opera 12.xx must have pretty low expectations of the web though, right? Even if it is really _only_ CloudFlare, they must be used to seeing that?
      - rasz_pl 11y ago
        so far its only been hobby/torrent/scam sites using free cert, nothing you would hesitate opening in a webproxy. Ill switch browsers when I can open ~100 tabs without eating 8GB of ram (blink engine), Opera 12.17 does it at <2GB, not to mention being able to configure everything per domain (js,blockers,cookies etc).
    - prdonahue 11y ago
      That listed was originally created based on minimum requirements for SNI. I've gone through recently and documented where versions need to be adjusted "up" based on requirement for ECDSA support. These changes will be posted as part of some other housekeeping work I have planned for cloudflare.com/ssl.
- jhall1468 11y ago
  IE 6, Android 2.X and IOS 3.X... I feel like a github project page is unlikely to have a lot of visitors running IE 6.
logical42 11y ago
Yeah but someone can still get between cloudflare and github pages since the traffic between the two end points would still be unencrypted and thus open to MITM..
- samwillis 11y ago
  Actually GitHub have ssl on their username.github.io domain so you can have full ssl from cloudflair back to GitHub.
  - sneak 11y ago
    Which unfortunately doesn't work with CloudFlare on a different domain because it sends the custom domain Host header.
    - prdonahue 11y ago
      You can use a Page Rule to override this host header with whatever you like: https://support.cloudflare.com/hc/en-us/articles/206652947-Using-Page-Rules-to-Re-Write-Host-Headers https://support.cloudflare.com/hc/en-us/articles/206652947-U....
      - sneak 11y ago
        Enterprise plans only. I thought "do all of this for free" was implicit in the request to GitHub.
- lucaspiller 11y ago
  Actually Cloudflare supports SSL on the backend (as a paid feature) so the only place it could be MITMed is in their network. I'd still like to see it a bit stricter in that I can specify my own self-signed CA that they validate against. https://blog.cloudflare.com/introducing-strict-ssl-protecting-against-a-man-in-the-middle-attack-on-origin-traffic/ https://blog.cloudflare.com/introducing-strict-ssl-protectin...
  - 11y ago

deleted 11y ago

[deleted]

rasz_pl 11y ago

and doesnt work in older browsers - free cloudflare cert is ECDHE

crymer11 11y ago
As some who cares both about accessibility on the web and security, what up-to-date browsers don't support ECDHE and what else would be reasonable to support as well?
- rasz_pl 11y ago
  probably nothing up-to-date, hence I wrote older :) Opera 12.xx being one of the older browsers that works 99% of the time, except EVERY SINGLE page with Cloudflare cert What makes matters worse is CloudFlare lying about support level: https://support.cloudflare.com/hc/en-us/articles/203041594-What-browsers-work-with-CloudFlare-s-SSL-certificates- https://support.cloudflare.com/hc/en-us/articles/203041594-W... They claim Opera 8, 2005 browser supports ecdhe.
  - russell_h 11y ago
    At this point anyone using Opera 12.xx must have pretty low expectations of the web though, right? Even if it is really _only_ CloudFlare, they must be used to seeing that?
    - rasz_pl 11y ago
      so far its only been hobby/torrent/scam sites using free cert, nothing you would hesitate opening in a webproxy. Ill switch browsers when I can open ~100 tabs without eating 8GB of ram (blink engine), Opera 12.17 does it at <2GB, not to mention being able to configure everything per domain (js,blockers,cookies etc).
  - prdonahue 11y ago
    That listed was originally created based on minimum requirements for SNI. I've gone through recently and documented where versions need to be adjusted "up" based on requirement for ECDSA support. These changes will be posted as part of some other housekeeping work I have planned for cloudflare.com/ssl.
jhall1468 11y ago
IE 6, Android 2.X and IOS 3.X... I feel like a github project page is unlikely to have a lot of visitors running IE 6.

logical42 11y ago

Yeah but someone can still get between cloudflare and github pages since the traffic between the two end points would still be unencrypted and thus open to MITM..

samwillis 11y ago
Actually GitHub have ssl on their username.github.io domain so you can have full ssl from cloudflair back to GitHub.
- sneak 11y ago
  Which unfortunately doesn't work with CloudFlare on a different domain because it sends the custom domain Host header.
  - prdonahue 11y ago
    You can use a Page Rule to override this host header with whatever you like: https://support.cloudflare.com/hc/en-us/articles/206652947-Using-Page-Rules-to-Re-Write-Host-Headers https://support.cloudflare.com/hc/en-us/articles/206652947-U....
    - sneak 11y ago
      Enterprise plans only. I thought "do all of this for free" was implicit in the request to GitHub.
lucaspiller 11y ago
Actually Cloudflare supports SSL on the backend (as a paid feature) so the only place it could be MITMed is in their network. I'd still like to see it a bit stricter in that I can specify my own self-signed CA that they validate against. https://blog.cloudflare.com/introducing-strict-ssl-protecting-against-a-man-in-the-middle-attack-on-origin-traffic/ https://blog.cloudflare.com/introducing-strict-ssl-protectin...
- 11y ago