5 ms·
As far as I know, Github pages doesn't support https for custom domains [1]. A better option for free hosting would be netlify, which supports Let's encrypt for
by trextrex 9y ago
As far as I know, Github pages doesn't support https for custom domains [1]. A better option for free hosting would be netlify, which supports Let's encrypt for custom domains.
[1] https://github.com/isaacs/github/issues/156 https://github.com/isaacs/github/issues/156
- austenallred 9y agoWe use cloudflare on our Github pages custom domain, so you can easily get https support that way.
- JorgeGT 9y agoIt is exactly what the article author suggests in fact: > Github pages does not offer secured custom domain name. The best way to get this feature for free is to use Cloudflare. [The article then proceeds on how exactly do that.]
- trextrex 9y agoYes, but cloudflare issues only shared certificates (that are shared across multiple domains) on their free plan [1]. If I wanted to use a dedicated certificate I'd have to upgrade to a paid plan. [1] https://support.cloudflare.com/hc/en-us/articles/203349264-Are-Cloudflare-s-SSL-certificates-shared-or-dedicated- https://support.cloudflare.com/hc/en-us/articles/203349264-A...
- thesmallestcat 9y agoPeople need to stop calling Cloudflare's offering HTTPS support. It's snake oil.
- chrift 9y agoThis is the first time I've heard such claims. Do you have any more details about this?
- ejcx 9y agoOP will undoubtedly not have more info. It's not snake-oil. I used to work there. There's a real TLS connection.
- sleepychu 9y ago+------------------+ +------------------+ +-----------------------+ | | | | | | | CLIENT | +----------> | CLOUDFLARE | +---------> | YOU | | | SSL | | NOT SSL | | +------------------+ +------------------+ +-----------------------+
- orf 9y agoHow so? Shared SSL cert is still an SSL cert. Not snake oil.
- dan1234 9y agoBut doing that won't protect the route between Cloudflare and Github pages, only the route between the user and Cloudflare.
- schrodinger 9y agoWouldn't SSL via GitHub's cert protect that part?
- xxdesmus 9y agoYes. It will.
- icebraining 9y agoNot really. They have two options for protecting the "back" connection: Full SSL and Full SSL (Strict). Full SSL doesn't really protect you since Cloudflare won't check if the certificate is valid, an attacker could make their own self-signed cert and MITM you. Full SSL (Strict) requires a valid cert for the domain being requested. If you had that, you wouldn't need Cloudflare in the first place.
- schrodinger 9y agoBut the domain is github.com, which has a valid ssl cert. You only need cloudflare to get it on your own domain.
- icebraining 9y agoRight, but Cloudflare doesn't actually check if the cert is valid, unless you enable Strict mode, which you can't because you'd need Github to serve a cert for your own domain.
- schrodinger 9y agoAre you sure? Wouldn't it check to see that the cert is valid for github.com, not for your own domain, since that's the origin? Edit: Looks like you're correct. Sorry!
- ic4l 9y agoIt's also worth noting that you can just toss cloud-flare in front of it to get HTTPS.
- paulgb 9y ago+1 for Netlify. It's like GitHub pages but with all the features you've ever wished it had.
- kaushalmodi 9y ago+1 for Netlify, and their amazing customer service via chat.