8 ms·
Does anyone know if github is planning to support https for custom domains?
by pfista 10y ago
Does anyone know if github is planning to support https for custom domains?
- max_ 10y agoCurrently, they don't have plans. just use cloudflare.
- mlissner 10y agoThat doesn't actually create a properly encrypted connection. It only encrypts between the user and the site (at CloudFlare), not between the site and Github. Without that last hop being encrypted, you have to weigh whether this is an improvement or not.
- JeremyBanks 10y agoIt significantly decreases the attack surface, since most of the connection will be encrypted inside CloudFare's network or over HTTPs. Should be a clear win for most cases.
- manigandham 10y agoYes it does - this is all a setting you can choose and since Github does support HTTPS (and has for a while) you can always set it on "strict" and ensure a continuous encrypted connection on both sides of CloudFlare.
- MichaelGG 10y agoBut what certificate will Github present for your custom domain? I don't think you can tell CF to accept Github pages's cert for your own domain. They either use their own CA or don't do auth, right? At least on non-enterprise plans.
- manigandham 10y agoCloudFlare is what serves your custom domain. On the backend you point CloudFlare to https://username.github.io https://username.github.io and CF will receive the wildcard certificate for *.github.io
- MichaelGG 10y agoHow do you do that in CloudFlare? I didn't know you could change the host in non-enterprise versions. All I've seen is the ability to proxy request to a specific IP or CNAME. If you CNAME your site to foo.github.com, it doesn't change the R-URI or Host header.
- 2bitencryption 10y agohttps://www.benburwell.com/posts/configuring-cloudflare-universal-ssl/ https://www.benburwell.com/posts/configuring-cloudflare-univ...
- MichaelGG 10y agoThat article doesn't address what I said at all. That's showing how to disable encryption on the backend (CF to Github) by selecting "Flexible". Looking at CF's help again and having used them a bit, there seems to be no way at all to enable full encryption (user-CF-github) with CF's non-enterprise offerings. This is because the request from CF to Github is still requested with your domain name (TLS and host header). In order for it to work with Github's *.github.io cert, Cloudflare would need to offer an option to rewrite the request itself, not just proxy it.
- manigandham 10y agoYou're right that the host header wouldn't match but Cloudflare has an option to enable SSL to origin without checking for completely validated certificate. They call this Full rather than Strict: https://www.cloudflare.com/a/static/images/ssl/ssl.png https://www.cloudflare.com/a/static/images/ssl/ssl.png So you can still get an encrypted connection without a verified certificate.
- nsgi 10y agoYou can now actually use CloudFlare to issue a custom certificate for your origin server that it will accept (CloudFlare Origin CA), but of course GitHub pages won't support installing it.
- ivanoats 10y agoNot as yet. Check out https://www.aerobatic.com https://www.aerobatic.com
- avyfain 10y ago"HTTPS is not supported for GitHub Pages using custom domains"[1] which is annoying. [1]: https://help.github.com/articles/securing-your-github-pages-site-with-https/ https://help.github.com/articles/securing-your-github-pages-...
- rev_bird 10y agoCustom domains would be huge for me, but I totally understand. How would they ever manage to do it? They'd either need a zillion separate entries, or the broadest wildcard cert ever.
- MichaelGG 10y agoSeparate entries in what? Computers do pretty good at handling many "entries". TLS will indicate the host so they can send the right cert back.
- rev_bird 10y agoSorry, I meant in an Apache config file or something.
- oakwhiz 10y agoLet's Encrypt?
- libeclipse 10y agoOr they could let users specify their own certs.
- nsgi 10y agoLots of certificates with 100 hostnames each is how CloudFlare does it.
- konklone 10y agoWordpress did this by issuing Let's Encrypt certs on demand for every domain people CNAME their way.
- amccloud 10y agoNot until Fastly (Github's CDN) makes it possible.
- abritinthebay 10y agoFastly does support https so I'm assuming it's a configuration problem.
- ecesena 10y agoFrequently changing pk enc key to setup tls connections with different certs can have a performance impact too. Let alone security implications of managing someone else's private keys.
- abritinthebay 10y agoTrue, but that is a config problem to be fair
- bobfunk 10y agoCheck out https://www.netlify.com https://www.netlify.com (disclaimer, I'm a co-founder). It's like GitHub pages on steroids and includes free Let's Encrypt based SSL for custom domains, can run builds from your GitHub repo with any static site generator, supports rewrite/redirect rules/proxying/form processing/password protection and much more...
- philtar 10y agoI consider your pricing to be completely out of touch with reality.
- lucaspiller 10y agoWhat sort of price would you consider good for static site hosting? GitHub provide theirs for free as it's a loss-leader, where as this is ther main business.
- HappyTypist 10y ago$4 a month (billed monthly) for 5 GB storage. Gotta be cheaper than digital ocean.
- reacweb 10y agoI love my hosting (https://www.scaleway.com/pricing/#pricing_baremetal https://www.scaleway.com/pricing/#pricing_baremetal): 3.6 € for 50 GB and total freedom.
- philtar 10y agoSomething not based on made up metrics like domain names. I'm actually using up space, bandwidth and CI time. Charge me on that.
- fenaer 10y agoYour pricing model is extraordinarily expensive.
- 10y ago
- skhaz29a 10y agoI added https for my personal blog using cloudflare
- 2bitencryption 10y agoSame. It took me all of ten minutes to do, with a free account. Now, if I were running some service or a huge site, I'd probably want https setup on the server side and not just use Cloudflare as an inbetween. But for a personal blog it does everything I need it to do, with zero hassle.