Another option, similar to some of the top-level comments suggesting Cloudflare with GitHub pages, is to use Cloudflare's long-lived internal origin certificate

Another option, similar to some of the top-level comments suggesting Cloudflare with GitHub pages, is to use Cloudflare's long-lived internal origin certificate on GitLab and Cloudflare's public externally-valid certificate for end-users. Although I have to admit to not actually having set that up yet: it's on my to-do list for a personal site that's in-progress this week.