3 ms·

Or put the domain on cloudflare. My site is hosted on github too, with a CF cert. Works fine with https :)

• inglor 11y ago
  Wouldn't that either cost money or only secure the connection from the client to cloudflare? From what I understand (and I admit, my knowledge is pretty lacking around what cloudflare offers) the free part is only the security between the client and cloudflare (and not the security between cloudflare and your server). On one hand it's better than nothing as I assume most MITMs are on local wifis and such but on the other it gives users a false sense of security. Then again none of this is of actual concern for node.green
  • bpicolo 11y ago
    It's a static site. Security between cloudflare and client seems like plenty
    • paulddraper 11y ago
      client <-> cloudflare and cloudflare <-> server are the same.
      • bpicolo 11y ago
        Not necessarily true in the case of government intervention
  • manojlds 11y ago
    Yeah, the free version is HTTPS only between client and CF. I made my blog hosted on Github HTTPS with this, mainly so that I can experiment some features like Service Workers.
    • adrianmacneil 11y ago
      Source? Last time I used it you could encrypt both hops (although you obviously need to tell CF to ignore the cert mismatch for backend server).
      • gkop 11y ago
        Yes, I use free CF with both hops encrypted. There's no way for my visitors to know this though. IMO CF should require both hops be encrypted.
      • kevincox 11y ago
        They are both encrypted but since you can't verify the "server" certificate it is vulnerable to MITM.
  • profmonocle 11y ago
    > From what I understand (and I admit, my knowledge is pretty lacking around what cloudflare offers) the free part is only the security between the client and cloudflare (and not the security between cloudflare and your server). The free plan also supports securing the connection between CloudFlare and your server.