2 ms·
It doesn't really matter for a blog without auth, but when you are using cloudflare's https, the connection is not encryptes between CF and GitHub, so it's not
by scrollaway 9y ago
It doesn't really matter for a blog without auth, but when you are using cloudflare's https, the connection is not encryptes between CF and GitHub, so it's not end to end encrypted.
I recommend simply migrating even if you keep the DNS itself on cloudflare. It's a good exercise if nothing else.
- icebraining 9y agoIt can be encrypted if you're using Full SSL on Cloudflare[1], but it's not authenticated, meaning anyone actively MITMing the connection between CF and GH could easily read and change the traffic. That said, it's not any script-kiddie who can MITM a connection between two DCs, so I think it's hardly a grave threat. I think the only real gain is not allowing CF itself to see who is accessing your blog. [1] https://support.cloudflare.com/hc/en-us/articles/200170416-What-do-the-SSL-options-mean- https://support.cloudflare.com/hc/en-us/articles/200170416-W...
- scrollaway 9y agoYou can't use full ssl with let's encrypt, which is fundamentally incompatible with proxying. But yes as I said it doesn't matter for a blog in practice.
- icebraining 9y agoYou can't use full ssl with let's encrypt, which is fundamentally incompatible with producing. I don't understand this statement, sorry.
- scrollaway 9y agoPhone autocorrected :) I meant proxying.
- icebraining 9y agoAh, ok. But how so? You can get a LE cert as long as you can serve a file in the correct URL, or set a certain DNS record. I don't see why proxying would prevent that.
- theoctopus 9y agoIt does work, I have a LE cert running behind cloudflare for Full SSL.
- scrollaway 9y agoOh, of course. I was thinking of Let's Encrypt's DNS-based authentication since that's the only thing I use nowadays (though of course Github isn't using that). Ignore me.