4 ms·

But doing that won't protect the route between Cloudflare and Github pages, only the route between the user and Cloudflare.

• schrodinger 9y ago
  Wouldn't SSL via GitHub's cert protect that part?
  • xxdesmus 9y ago
    Yes. It will.
    • icebraining 9y ago
      Not really. They have two options for protecting the "back" connection: Full SSL and Full SSL (Strict). Full SSL doesn't really protect you since Cloudflare won't check if the certificate is valid, an attacker could make their own self-signed cert and MITM you. Full SSL (Strict) requires a valid cert for the domain being requested. If you had that, you wouldn't need Cloudflare in the first place.
      • schrodinger 9y ago
        But the domain is github.com, which has a valid ssl cert. You only need cloudflare to get it on your own domain.
        • icebraining 9y ago
          Right, but Cloudflare doesn't actually check if the cert is valid, unless you enable Strict mode, which you can't because you'd need Github to serve a cert for your own domain.
          • schrodinger 9y ago
            Are you sure? Wouldn't it check to see that the cert is valid for github.com, not for your own domain, since that's the origin? Edit: Looks like you're correct. Sorry!