3 ms·
Those are uninformed comments.
by prdonahue 9y ago
Those are uninformed comments.
- icebraining 9y agoThose comments are saying that because the last hop (Cloudflare → Github) will still be unencrypted. You may disagree that it doesn't make it insecure, but that doesn't mean they're uninformed.
- Santosh83 9y agoThe FULL option in fact requires HTTPS even for the last hop. It just accepts any certificate which isn't as good as only accepting a valid certificate. But the last hop doesn't have to be clear-text any more.
- icebraining 9y agoRight, but if someone can snoop the connection between Cloudflare and your server, chances are they are in control of some intermediate machine and can MITM, injecting their own self-signed cert.
- jgrahamc 9y agoNo reason to use Full. You can stick a Let's Encrypt or free Cloudflare Origin CA cert on the origin. Enable Strict.
- lorenzhs 9y agoHow do I do that with GitHub pages? In my case (glowing-bear.org), I'd like to tell Cloudflare to accept valid certificates for glowing-bear.github.io (or * .github.io) because that's the origin certificate. But I haven't found an option to do so.
- Santosh83 9y agoGithub has no provision for this. So it's more a Github issue than a Cloudflare one. The latter has the Full (but not strict) SSL option for precisely this situation, which is arguably better than going with Flexible SSL.