Hacker News Reader

Comment by leighmcculloch | Hacker News Reader

You can use CloudFlare with a custom domain in front of Github Pages. It works. I do this for https://github.com/leighmcculloch/5tweets.com which you can see SSL'd at https://5tweets.com.

View on HN

Yeah but someone can still get between cloudflare and github pages since the traffic between the two end points would still be unencrypted and thus open to MITM..

Actually GitHub have ssl on their username.github.io domain so you can have full ssl from cloudflair back to GitHub.

Which unfortunately doesn't work with CloudFlare on a different domain because it sends the custom domain Host header.

You can use a Page Rule to override this host header with whatever you like: https://support.cloudflare.com/hc/en-us/articles/206652947-U....

Enterprise plans only. I thought "do all of this for free" was implicit in the request to GitHub.

Actually Cloudflare supports SSL on the backend (as a paid feature) so the only place it could be MITMed is in their network. I'd still like to see it a bit stricter in that I can specify my own self-signed CA that they validate against.

https://blog.cloudflare.com/introducing-strict-ssl-protectin...

There's nothing "paid" about specifying how we connect to your origin (i.e., with HTTPS or HTTP). This setting is available to all plans, free or otherwise.

During onboarding we attempt to establish a connection to your origin using HTTPS. If successful (i.e., your http daemon is listening on TCP 443, speaks TLS, and presents a certificate), we'll default you to using "Full" mode; if not, "Flexible" mode will be set.

Either way, this setting can be changed at any time: simply log in and click the Crypto app in our top level nav. The setting you are looking for is the first one presented on the screen.

In terms of your second comment, we're planning on rolling out a simple way for you to install a free CloudFare-signed certificate on your origin and use that in Strict mode ("Full" with full chain validation). Don't have a GA date for this yet, but it will be announced on our blog once available to all (still in beta).

Source: CloudFlare TLS PM

yes, but it's static public pages. it's a pretty big stretch. it's not like users are POSTing confidential data up to your site.

You may well be hosting or linking to builds though, and if someone could replace a popular project's binary builds with one that'll compromise any machine its installed on that's a pretty big deal, especially if some of those machines are production servers.

But you can download stuff you've uploaded and check that everything's in order, right?

and doesnt work in older browsers - free cloudflare cert is ECDHE

As some who cares both about accessibility on the web and security, what up-to-date browsers don't support ECDHE and what else would be reasonable to support as well?

probably nothing up-to-date, hence I wrote older :) Opera 12.xx being one of the older browsers that works 99% of the time, except EVERY SINGLE page with Cloudflare cert

What makes matters worse is CloudFlare lying about support level: https://support.cloudflare.com/hc/en-us/articles/203041594-W...

They claim Opera 8, 2005 browser supports ecdhe.

At this point anyone using Opera 12.xx must have pretty low expectations of the web though, right? Even if it is really _only_ CloudFlare, they must be used to seeing that?

so far its only been hobby/torrent/scam sites using free cert, nothing you would hesitate opening in a webproxy.

Ill switch browsers when I can open ~100 tabs without eating 8GB of ram (blink engine), Opera 12.17 does it at <2GB, not to mention being able to configure everything per domain (js,blockers,cookies etc).

That listed was originally created based on minimum requirements for SNI. I've gone through recently and documented where versions need to be adjusted "up" based on requirement for ECDSA support. These changes will be posted as part of some other housekeeping work I have planned for cloudflare.com/ssl.

IE 6, Android 2.X and IOS 3.X...

I feel like a github project page is unlikely to have a lot of visitors running IE 6.

Reply on news.ycombinator.com