5 ms·

We use cloudflare on our Github pages custom domain, so you can easily get https support that way.

JorgeGT 9y ago
It is exactly what the article author suggests in fact: > Github pages does not offer secured custom domain name. The best way to get this feature for free is to use Cloudflare. [The article then proceeds on how exactly do that.]
- trextrex 9y ago
  Yes, but cloudflare issues only shared certificates (that are shared across multiple domains) on their free plan [1]. If I wanted to use a dedicated certificate I'd have to upgrade to a paid plan. [1] https://support.cloudflare.com/hc/en-us/articles/203349264-Are-Cloudflare-s-SSL-certificates-shared-or-dedicated- https://support.cloudflare.com/hc/en-us/articles/203349264-A...
thesmallestcat 9y ago
People need to stop calling Cloudflare's offering HTTPS support. It's snake oil.
- chrift 9y ago
  This is the first time I've heard such claims. Do you have any more details about this?
  - ejcx 9y ago
    OP will undoubtedly not have more info. It's not snake-oil. I used to work there. There's a real TLS connection.
  - sleepychu 9y ago
    +------------------+ +------------------+ +-----------------------+ | | | | | | | CLIENT | +----------> | CLOUDFLARE | +---------> | YOU | | | SSL | | NOT SSL | | +------------------+ +------------------+ +-----------------------+
- orf 9y ago
  How so? Shared SSL cert is still an SSL cert. Not snake oil.
dan1234 9y ago
But doing that won't protect the route between Cloudflare and Github pages, only the route between the user and Cloudflare.
- schrodinger 9y ago
  Wouldn't SSL via GitHub's cert protect that part?
  - xxdesmus 9y ago
    Yes. It will.
    - icebraining 9y ago
      Not really. They have two options for protecting the "back" connection: Full SSL and Full SSL (Strict). Full SSL doesn't really protect you since Cloudflare won't check if the certificate is valid, an attacker could make their own self-signed cert and MITM you. Full SSL (Strict) requires a valid cert for the domain being requested. If you had that, you wouldn't need Cloudflare in the first place.
      - schrodinger 9y ago
        But the domain is github.com, which has a valid ssl cert. You only need cloudflare to get it on your own domain.
        icebraining 9y ago
        Right, but Cloudflare doesn't actually check if the cert is valid, unless you enable Strict mode, which you can't because you'd need Github to serve a cert for your own domain.
        schrodinger 9y ago
        Are you sure? Wouldn't it check to see that the cert is valid for github.com, not for your own domain, since that's the origin? Edit: Looks like you're correct. Sorry!

It is exactly what the article author suggests in fact: > Github pages does not offer secured custom domain name. The best way to get this feature for free is to use Cloudflare. [The article then proceeds on how exactly do that.]

trextrex 9y ago
Yes, but cloudflare issues only shared certificates (that are shared across multiple domains) on their free plan [1]. If I wanted to use a dedicated certificate I'd have to upgrade to a paid plan. [1] https://support.cloudflare.com/hc/en-us/articles/203349264-Are-Cloudflare-s-SSL-certificates-shared-or-dedicated- https://support.cloudflare.com/hc/en-us/articles/203349264-A...

thesmallestcat 9y ago

People need to stop calling Cloudflare's offering HTTPS support. It's snake oil.

chrift 9y ago
This is the first time I've heard such claims. Do you have any more details about this?
- ejcx 9y ago
  OP will undoubtedly not have more info. It's not snake-oil. I used to work there. There's a real TLS connection.
- sleepychu 9y ago
  +------------------+ +------------------+ +-----------------------+ | | | | | | | CLIENT | +----------> | CLOUDFLARE | +---------> | YOU | | | SSL | | NOT SSL | | +------------------+ +------------------+ +-----------------------+
orf 9y ago
How so? Shared SSL cert is still an SSL cert. Not snake oil.

dan1234 9y ago

But doing that won't protect the route between Cloudflare and Github pages, only the route between the user and Cloudflare.

schrodinger 9y ago
Wouldn't SSL via GitHub's cert protect that part?
- xxdesmus 9y ago
  Yes. It will.
  - icebraining 9y ago
    Not really. They have two options for protecting the "back" connection: Full SSL and Full SSL (Strict). Full SSL doesn't really protect you since Cloudflare won't check if the certificate is valid, an attacker could make their own self-signed cert and MITM you. Full SSL (Strict) requires a valid cert for the domain being requested. If you had that, you wouldn't need Cloudflare in the first place.
    - schrodinger 9y ago
      But the domain is github.com, which has a valid ssl cert. You only need cloudflare to get it on your own domain.
      - icebraining 9y ago
        Right, but Cloudflare doesn't actually check if the cert is valid, unless you enable Strict mode, which you can't because you'd need Github to serve a cert for your own domain.
        schrodinger 9y ago
        Are you sure? Wouldn't it check to see that the cert is valid for github.com, not for your own domain, since that's the origin? Edit: Looks like you're correct. Sorry!