5 ms·

No TLS on jenkins-x.com, tisk tisk.

tuananh 8y ago
it's using github pages for the main website i think so i'm not sure if it's possible to setup custom domain + custom ssl cert for it?
- jsmeaton 8y ago
  I've used cloudflare to do SSL for a custom github pages domain before.
- nodesocket 8y ago
  Should be able to use CloudFlare and "flexible" SSL setup. CNAME at the apex pointing to GitHub pages.
  - manigandham 8y ago
    You should set it to "Full" instead. That will use TLS but won't verify the domain name in the certificate like it does in "Strict" mode so you can still use Github pages.
  - LethargicStud 8y ago
    Please don't do this. It gives the user the illusion that their connection is secure, but the connection between Cloudflare and the site is not secure. Arguably it's better to encrypt some of the route rather than none of it, but also giving people a false sense of security comes with its own drawbacks.
    - nodesocket 8y ago
      Actually "flexible" might not be needed, "full" without strict should work. Traffic is still over TLS, but a valid named certificate is not required.
    - deleted 8y ago
      [deleted]
    - jhasse 8y ago
      I think the user mostly cares about his connection to anything outside his network (e.g. for public WiFis).
- samridh90 8y ago
  It's possible but not very straightforward. Reference for anyone else trying to setup ssl cert for github pages: https://www.jonathan-petitcolas.com/2017/01/13/using-https-with-custom-domain-name-on-github-pages.html https://www.jonathan-petitcolas.com/2017/01/13/using-https-w...
- EnderMB 8y ago
  For a long time it wasn't, but it looks like GitHub are slowly rolling this out to people. Given that Jenkins is pretty popular, you'd think that they'd be able to sort something out with GitHub to get bumped up the list for something along these lines. There's always the Cloudfare option, but I've never felt that this was an ideal solution when HTTPS should be extremely straightforward for GitHub to set up on their pages.
spockz 8y ago
I’m using netlify[1] to host my site and it supports tls on public domains - through let’s encrypt - and http2 out of the box. [1]: https://www.netlify.com/ https://www.netlify.com/
pronoiac 8y ago
Huh, they're using Github pages. I thought if you set up a redirect - a C dns response - to whatever.github.io, that would soothe the ssl complaints in the browser. Looking at the dns records, it looks like they didn't do this, and instead set up an A record. I realized Github probably documents this, and found: https://help.github.com/articles/using-a-custom-domain-with-github-pages/ https://help.github.com/articles/using-a-custom-domain-with-... My suggestion would likely work for a www subdomain, but not for the apex domain.
jstrachan 8y ago
whoops, great catch thanks. Hoping we can figure out a fix very soon...

it's using github pages for the main website i think so i'm not sure if it's possible to setup custom domain + custom ssl cert for it?

jsmeaton 8y ago
I've used cloudflare to do SSL for a custom github pages domain before.
nodesocket 8y ago
Should be able to use CloudFlare and "flexible" SSL setup. CNAME at the apex pointing to GitHub pages.
- manigandham 8y ago
  You should set it to "Full" instead. That will use TLS but won't verify the domain name in the certificate like it does in "Strict" mode so you can still use Github pages.
- LethargicStud 8y ago
  Please don't do this. It gives the user the illusion that their connection is secure, but the connection between Cloudflare and the site is not secure. Arguably it's better to encrypt some of the route rather than none of it, but also giving people a false sense of security comes with its own drawbacks.
  - nodesocket 8y ago
    Actually "flexible" might not be needed, "full" without strict should work. Traffic is still over TLS, but a valid named certificate is not required.
  - deleted 8y ago
    [deleted]
  - jhasse 8y ago
    I think the user mostly cares about his connection to anything outside his network (e.g. for public WiFis).
samridh90 8y ago
It's possible but not very straightforward. Reference for anyone else trying to setup ssl cert for github pages: https://www.jonathan-petitcolas.com/2017/01/13/using-https-with-custom-domain-name-on-github-pages.html https://www.jonathan-petitcolas.com/2017/01/13/using-https-w...
EnderMB 8y ago
For a long time it wasn't, but it looks like GitHub are slowly rolling this out to people. Given that Jenkins is pretty popular, you'd think that they'd be able to sort something out with GitHub to get bumped up the list for something along these lines. There's always the Cloudfare option, but I've never felt that this was an ideal solution when HTTPS should be extremely straightforward for GitHub to set up on their pages.

spockz 8y ago

I’m using netlify[1] to host my site and it supports tls on public domains - through let’s encrypt - and http2 out of the box. [1]: https://www.netlify.com/ https://www.netlify.com/

pronoiac 8y ago

Huh, they're using Github pages. I thought if you set up a redirect - a C dns response - to whatever.github.io, that would soothe the ssl complaints in the browser. Looking at the dns records, it looks like they didn't do this, and instead set up an A record. I realized Github probably documents this, and found: https://help.github.com/articles/using-a-custom-domain-with-github-pages/ https://help.github.com/articles/using-a-custom-domain-with-... My suggestion would likely work for a www subdomain, but not for the apex domain.

jstrachan 8y ago

whoops, great catch thanks. Hoping we can figure out a fix very soon...