6 ms·

You can use Full SSL on CloudFlare with GitHub Pages, which is end to end. https://blog.cloudflare.com/secure-and-fast-github-pages-with-cloudflare/ https://bl

by 7ewis 9y ago

You can use Full SSL on CloudFlare with GitHub Pages, which is end to end. https://blog.cloudflare.com/secure-and-fast-github-pages-with-cloudflare/ https://blog.cloudflare.com/secure-and-fast-github-pages-wit...

rolodato 9y ago
It is end to end but CloudFlare does not verify the identity of the origin server. The only equivalent option would be "Full SSL (Strict)", which is not free.
- tonyztan 9y ago
  I believe Strict SSL is free on Cloudflare's side, but GitHub Pages does not work with it because it does not present a matching and valid certificate. https://support.cloudflare.com/hc/en-us/articles/200170416-What-do-the-SSL-options-mean- https://support.cloudflare.com/hc/en-us/articles/200170416-W...
  - rolodato 9y ago
    I stand corrected :)
- jgrahamc 9y ago
  That is simply untrue. Full SSL (Strict) is available on all plan levels including free. There is no charge for it. In addition, if you don't have an SSL certificate on your origin we'll give you a cert for free as well: https://blog.cloudflare.com/cloudflare-ca-encryption-origin/ https://blog.cloudflare.com/cloudflare-ca-encryption-origin/
tonyztan 9y ago
End-to-end secure, but only against passive attacks. Cloudflare "Full SSL" (as opposed to "Strict SSL") does not verify the certificate presented by the origin server, so someone sitting between Cloudflare and your origin can still MITM the connection without detection. Strict SSL does not currently work with GitHub Pages, because "*.github.io" certs do not match custom domains. https://www.cloudflare.com/ssl/ https://www.cloudflare.com/ssl/ https://github.com/isaacs/github/issues/156#issuecomment-110490178 https://github.com/isaacs/github/issues/156#issuecomment-110...
- prdonahue 9y ago
  We're working on making Strict mode work better in such situations. For example, if the origin server presents a certificate with a SAN for *.github.io and you have a CNAME to yourusername.github.io, this will (soon) validate as Strict.
  - tonyztan 9y ago
    That's great news! I've been hoping Cloudflare would allow customized cert validation (i.e. the user specifies a domain name to verify against, in the control panel). At least the improvement you mention will increase compatibility with GitHub Pages and others.
  - deleted 9y ago
    [deleted]
  - Santosh83 9y ago
    Wow this is great news! As someone who finds GitHub Pages with Cloudflare nearly perfect for my simple site, this change would make it even more so!

by 7ewis 9y ago

rolodato 9y ago

It is end to end but CloudFlare does not verify the identity of the origin server. The only equivalent option would be "Full SSL (Strict)", which is not free.

tonyztan 9y ago
I believe Strict SSL is free on Cloudflare's side, but GitHub Pages does not work with it because it does not present a matching and valid certificate. https://support.cloudflare.com/hc/en-us/articles/200170416-What-do-the-SSL-options-mean- https://support.cloudflare.com/hc/en-us/articles/200170416-W...
- rolodato 9y ago
  I stand corrected :)
jgrahamc 9y ago
That is simply untrue. Full SSL (Strict) is available on all plan levels including free. There is no charge for it. In addition, if you don't have an SSL certificate on your origin we'll give you a cert for free as well: https://blog.cloudflare.com/cloudflare-ca-encryption-origin/ https://blog.cloudflare.com/cloudflare-ca-encryption-origin/

tonyztan 9y ago

End-to-end secure, but only against passive attacks. Cloudflare "Full SSL" (as opposed to "Strict SSL") does not verify the certificate presented by the origin server, so someone sitting between Cloudflare and your origin can still MITM the connection without detection. Strict SSL does not currently work with GitHub Pages, because "*.github.io" certs do not match custom domains. https://www.cloudflare.com/ssl/ https://www.cloudflare.com/ssl/ https://github.com/isaacs/github/issues/156#issuecomment-110490178 https://github.com/isaacs/github/issues/156#issuecomment-110...

prdonahue 9y ago
We're working on making Strict mode work better in such situations. For example, if the origin server presents a certificate with a SAN for *.github.io and you have a CNAME to yourusername.github.io, this will (soon) validate as Strict.
- tonyztan 9y ago
  That's great news! I've been hoping Cloudflare would allow customized cert validation (i.e. the user specifies a domain name to verify against, in the control panel). At least the improvement you mention will increase compatibility with GitHub Pages and others.
- deleted 9y ago
  [deleted]
- Santosh83 9y ago
  Wow this is great news! As someone who finds GitHub Pages with Cloudflare nearly perfect for my simple site, this change would make it even more so!