5 ms·

This is great -- it has a killer feature that I think GitHub Pages is sorely missing (unless it exists and I'm just ignorant to the fact). Custom domains WITH S

This is great -- it has a killer feature that I think GitHub Pages is sorely missing (unless it exists and I'm just ignorant to the fact). Custom domains WITH SSL. Right now I have my custom domain set up on GitHub, but it's not SSL. I would love to be able to do that.

codecurve 11y ago
Just for reference—you can achieve this if you run your site behind CloudFlare. I run my own blog this way.
- connorshea 11y ago
  That's not truly end-to-end encrypted though, right? The server -> CloudFlare goes over HTTP.
  - biot 11y ago
    That's one option; they also offer strict SSL on both sides of the connection: https://www.cloudflare.com/ssl/ https://www.cloudflare.com/ssl/ as well as keyless as slig pointed out in another comment.
  - everfree 11y ago
    When using GitHub Pages, the server -> CloudFlare goes over unauthenticated HTTPS (using the HTTPS "not strict" option), which means it is resistant to passive attackers but vulnerable to active MITM attackers.
the_mitsuhiko 11y ago
Do you have to hand over your private keys for that?
- mglinski 11y ago
  You do but you would likely make a new key for this specific domain so you don't have to hand over any important keys.
- kpcyrd 11y ago
  How would you do that without handing over your private keys? Otherwise gitlab couldn't serve your site. Also, as soon as you point an A record of your domain to somebodies server, they're able to get valid certificates through acme (which is probably what they do). If you don't trust somebody, don't point your domain to them.
  - slig 11y ago
    > How would you do that without handing over your private keys? CloudFlare has that figured out https://www.cloudflare.com/keyless-ssl/ https://www.cloudflare.com/keyless-ssl/
    - pfg 11y ago
      It depends on your goals. If your goal is to tick a compliance box saying "no third-party has access to our private key" or "our private key never leaves our DC", then they have it figured out. If you want an additional barrier between your web server and your private key for Heartbleed-like vulnerabilities, this is also viable solution. If your goal is to have end-to-end encryption between your server and a visitor, or hope this is going to protect you in case CloudFlare or GitLab are owned, then this isn't a real solution. CloudFlare has access to your session keys, and if they're owned, those can be logged and used to decrypt traffic. Even with a leaked private key, older sessions would be safe thanks to PFS ciphers, so Keyless SSL doesn't really change anything here.
  - tombrossman 11y ago
    It's entirely possible that GitLab could integrate Let's Encrypt and generate their own private keys. Some large shared hosting providers already do this (e.g. DreamHost). Keys are cheap and plentiful, just regenerate & reissue however often you like. The paid CAs I've used do free reissues with new CSRs no problem. You are already trusting them to serve your site so adding a private TLS key isn't a big deal. The only downside I could think of is if you are using HPKP with a long duration, you could have issues with rapidly changing keys. But I wouldn't expect GitLab Pages to support setting those headers so probably another non-issue.
zeeshanm 11y ago
Clourfare provides free SSL - just proxy through them.
- slig 11y ago
  edit: disregard, I was wrong. If I'm not mistaken, you have to change the DNS of the domain to something *.cloudflare.com to be able to use their service, so it won't work in this scenario.
  - _kush 11y ago
    It will. There is no need to change the nameservers of the domain for Github/Gitlab.
- atmosx 11y ago
  But the traffic after cloudflare's proxy is plaintext right? I know CloudFlare has better thing to do than sniffing websites but I don't see the point of installing an SSL certification using clouflare or any other third-party which will handle traffic the way they do. You don't own the certificate, they do.
  - biot 11y ago
    That's one option; they also offer strict SSL on both sides of the connection: https://www.cloudflare.com/ssl/ https://www.cloudflare.com/ssl/
    - iokanuon 11y ago
      How would that work if Github pages don't support SSL?
      - biot 11y ago
        GitHub supports SSL for *.github.io so you can have your custom domain with SSL on CloudFlare, and CloudFlare can proxy https://example.github.io/.. https://example.github.io/... on the other side. eg: End User <--> https://example.com https://example.com <--> CloudFlare <--> https://example.github.io https://example.github.io
bluetidepro 11y ago
> https://konklone.com/post/github-pages-now-sorta-supports-https-so-use-it https://konklone.com/post/github-pages-now-sorta-supports-ht... > https://sheharyar.me/blog/free-ssl-for-github-pages-with-custom-domains/ https://sheharyar.me/blog/free-ssl-for-github-pages-with-cus... Looks like you can, ("sorta")

codecurve 11y ago

Just for reference—you can achieve this if you run your site behind CloudFlare. I run my own blog this way.

connorshea 11y ago
That's not truly end-to-end encrypted though, right? The server -> CloudFlare goes over HTTP.
- biot 11y ago
  That's one option; they also offer strict SSL on both sides of the connection: https://www.cloudflare.com/ssl/ https://www.cloudflare.com/ssl/ as well as keyless as slig pointed out in another comment.
- everfree 11y ago
  When using GitHub Pages, the server -> CloudFlare goes over unauthenticated HTTPS (using the HTTPS "not strict" option), which means it is resistant to passive attackers but vulnerable to active MITM attackers.

the_mitsuhiko 11y ago

Do you have to hand over your private keys for that?

mglinski 11y ago
You do but you would likely make a new key for this specific domain so you don't have to hand over any important keys.
kpcyrd 11y ago
How would you do that without handing over your private keys? Otherwise gitlab couldn't serve your site. Also, as soon as you point an A record of your domain to somebodies server, they're able to get valid certificates through acme (which is probably what they do). If you don't trust somebody, don't point your domain to them.
- slig 11y ago
  > How would you do that without handing over your private keys? CloudFlare has that figured out https://www.cloudflare.com/keyless-ssl/ https://www.cloudflare.com/keyless-ssl/
  - pfg 11y ago
    It depends on your goals. If your goal is to tick a compliance box saying "no third-party has access to our private key" or "our private key never leaves our DC", then they have it figured out. If you want an additional barrier between your web server and your private key for Heartbleed-like vulnerabilities, this is also viable solution. If your goal is to have end-to-end encryption between your server and a visitor, or hope this is going to protect you in case CloudFlare or GitLab are owned, then this isn't a real solution. CloudFlare has access to your session keys, and if they're owned, those can be logged and used to decrypt traffic. Even with a leaked private key, older sessions would be safe thanks to PFS ciphers, so Keyless SSL doesn't really change anything here.
- tombrossman 11y ago
  It's entirely possible that GitLab could integrate Let's Encrypt and generate their own private keys. Some large shared hosting providers already do this (e.g. DreamHost). Keys are cheap and plentiful, just regenerate & reissue however often you like. The paid CAs I've used do free reissues with new CSRs no problem. You are already trusting them to serve your site so adding a private TLS key isn't a big deal. The only downside I could think of is if you are using HPKP with a long duration, you could have issues with rapidly changing keys. But I wouldn't expect GitLab Pages to support setting those headers so probably another non-issue.

zeeshanm 11y ago

Clourfare provides free SSL - just proxy through them.

slig 11y ago
edit: disregard, I was wrong. If I'm not mistaken, you have to change the DNS of the domain to something *.cloudflare.com to be able to use their service, so it won't work in this scenario.
- _kush 11y ago
  It will. There is no need to change the nameservers of the domain for Github/Gitlab.
atmosx 11y ago
But the traffic after cloudflare's proxy is plaintext right? I know CloudFlare has better thing to do than sniffing websites but I don't see the point of installing an SSL certification using clouflare or any other third-party which will handle traffic the way they do. You don't own the certificate, they do.
- biot 11y ago
  That's one option; they also offer strict SSL on both sides of the connection: https://www.cloudflare.com/ssl/ https://www.cloudflare.com/ssl/
  - iokanuon 11y ago
    How would that work if Github pages don't support SSL?
    - biot 11y ago
      GitHub supports SSL for *.github.io so you can have your custom domain with SSL on CloudFlare, and CloudFlare can proxy https://example.github.io/.. https://example.github.io/... on the other side. eg: End User <--> https://example.com https://example.com <--> CloudFlare <--> https://example.github.io https://example.github.io

bluetidepro 11y ago

> https://konklone.com/post/github-pages-now-sorta-supports-https-so-use-it https://konklone.com/post/github-pages-now-sorta-supports-ht... > https://sheharyar.me/blog/free-ssl-for-github-pages-with-custom-domains/ https://sheharyar.me/blog/free-ssl-for-github-pages-with-cus... Looks like you can, ("sorta")