3 ms·

I'm hosting my webpage on GitHub Pages, with a custom domain. Back when I set it up, Let's Encrypt would not work with GitHub Pages so instead I simply put my p

I'm hosting my webpage on GitHub Pages, with a custom domain. Back when I set it up, Let's Encrypt would not work with GitHub Pages so instead I simply put my page on Cloudflare. Should I spend the time and set it up again but with Let's Encrypt? I've heard people say bad stuff about Cloudflare, but dismissed it since my page is really just a blog.

Ajedi32 8y ago
Unless you personally have something against Cloudflare I'd say there's really no reason to bother changing anything. But yeah, if you point your domain directly at GitHub Pages instead of at Cloudflare then GitHub should just issue you a cert and start using it automatically.
mrkurt 8y ago
Open IP the cert you're using and see what other sites are listed on it. It probably includes a lot of sites that aren't yours. GitHub + Let's Encrypt gives you a clean cert for just your hostnames.
- ReverseCold 8y ago
  Just curious, why does that matter? It works and is secure, right?
michaelbuckbee 8y ago
An interesting alternative is Fly.io - you can setup everything to go through them with a backend that's your Github Page and they'll spin out LE certs on the fly for it.
scrollaway 8y ago
It doesn't really matter for a blog without auth, but when you are using cloudflare's https, the connection is not encryptes between CF and GitHub, so it's not end to end encrypted. I recommend simply migrating even if you keep the DNS itself on cloudflare. It's a good exercise if nothing else.
- icebraining 8y ago
  It can be encrypted if you're using Full SSL on Cloudflare[1], but it's not authenticated, meaning anyone actively MITMing the connection between CF and GH could easily read and change the traffic. That said, it's not any script-kiddie who can MITM a connection between two DCs, so I think it's hardly a grave threat. I think the only real gain is not allowing CF itself to see who is accessing your blog. [1] https://support.cloudflare.com/hc/en-us/articles/200170416-What-do-the-SSL-options-mean- https://support.cloudflare.com/hc/en-us/articles/200170416-W...
  - scrollaway 8y ago
    You can't use full ssl with let's encrypt, which is fundamentally incompatible with proxying. But yes as I said it doesn't matter for a blog in practice.
    - icebraining 8y ago
      You can't use full ssl with let's encrypt, which is fundamentally incompatible with producing. I don't understand this statement, sorry.
      - scrollaway 8y ago
        Phone autocorrected :) I meant proxying.
        icebraining 8y ago
        Ah, ok. But how so? You can get a LE cert as long as you can serve a file in the correct URL, or set a certain DNS record. I don't see why proxying would prevent that.
        theoctopus 8y ago
        It does work, I have a LE cert running behind cloudflare for Full SSL.

Ajedi32 8y ago

Unless you personally have something against Cloudflare I'd say there's really no reason to bother changing anything. But yeah, if you point your domain directly at GitHub Pages instead of at Cloudflare then GitHub should just issue you a cert and start using it automatically.

mrkurt 8y ago

Open IP the cert you're using and see what other sites are listed on it. It probably includes a lot of sites that aren't yours. GitHub + Let's Encrypt gives you a clean cert for just your hostnames.

ReverseCold 8y ago
Just curious, why does that matter? It works and is secure, right?

michaelbuckbee 8y ago

An interesting alternative is Fly.io - you can setup everything to go through them with a backend that's your Github Page and they'll spin out LE certs on the fly for it.

scrollaway 8y ago

It doesn't really matter for a blog without auth, but when you are using cloudflare's https, the connection is not encryptes between CF and GitHub, so it's not end to end encrypted. I recommend simply migrating even if you keep the DNS itself on cloudflare. It's a good exercise if nothing else.

icebraining 8y ago
It can be encrypted if you're using Full SSL on Cloudflare[1], but it's not authenticated, meaning anyone actively MITMing the connection between CF and GH could easily read and change the traffic. That said, it's not any script-kiddie who can MITM a connection between two DCs, so I think it's hardly a grave threat. I think the only real gain is not allowing CF itself to see who is accessing your blog. [1] https://support.cloudflare.com/hc/en-us/articles/200170416-What-do-the-SSL-options-mean- https://support.cloudflare.com/hc/en-us/articles/200170416-W...
- scrollaway 8y ago
  You can't use full ssl with let's encrypt, which is fundamentally incompatible with proxying. But yes as I said it doesn't matter for a blog in practice.
  - icebraining 8y ago
    You can't use full ssl with let's encrypt, which is fundamentally incompatible with producing. I don't understand this statement, sorry.
    - scrollaway 8y ago
      Phone autocorrected :) I meant proxying.
      - icebraining 8y ago
        Ah, ok. But how so? You can get a LE cert as long as you can serve a file in the correct URL, or set a certain DNS record. I don't see why proxying would prevent that.
        theoctopus 8y ago
        It does work, I have a LE cert running behind cloudflare for Full SSL.