Hacker News Reader

Comment by trextrex | Hacker News Reader

As far as I know, Github pages doesn't support https for custom domains [1]. A better option for free hosting would be netlify, which supports Let's encrypt for custom domains.

[1] https://github.com/isaacs/github/issues/156

View on HN

+1 for Netlify. It's like GitHub pages but with all the features you've ever wished it had.

We use cloudflare on our Github pages custom domain, so you can easily get https support that way.

It is exactly what the article author suggests in fact:

> Github pages does not offer secured custom domain name. The best way to get this feature for free is to use Cloudflare.

[The article then proceeds on how exactly do that.]

Yes, but cloudflare issues only shared certificates (that are shared across multiple domains) on their free plan [1]. If I wanted to use a dedicated certificate I'd have to upgrade to a paid plan.

[1] https://support.cloudflare.com/hc/en-us/articles/203349264-A...

People need to stop calling Cloudflare's offering HTTPS support. It's snake oil.

This is the first time I've heard such claims. Do you have any more details about this?

    +------------------+               +------------------+             +-----------------------+
    |                  |               |                  |             |                       |
    |    CLIENT        | +---------->  |    CLOUDFLARE    | +---------> |       YOU             |
    |                  |     SSL       |                  |   NOT SSL   |                       |
    +------------------+               +------------------+             +-----------------------+

OP will undoubtedly not have more info. It's not snake-oil. I used to work there. There's a real TLS connection.

How so? Shared SSL cert is still an SSL cert. Not snake oil.

But doing that won't protect the route between Cloudflare and Github pages, only the route between the user and Cloudflare.

Wouldn't SSL via GitHub's cert protect that part?

Yes. It will.

Not really. They have two options for protecting the "back" connection: Full SSL and Full SSL (Strict).

Full SSL doesn't really protect you since Cloudflare won't check if the certificate is valid, an attacker could make their own self-signed cert and MITM you.

Full SSL (Strict) requires a valid cert for the domain being requested. If you had that, you wouldn't need Cloudflare in the first place.

But the domain is github.com, which has a valid ssl cert. You only need cloudflare to get it on your own domain.

Right, but Cloudflare doesn't actually check if the cert is valid, unless you enable Strict mode, which you can't because you'd need Github to serve a cert for your own domain.

Are you sure? Wouldn't it check to see that the cert is valid for github.com, not for your own domain, since that's the origin?

Edit: Looks like you're correct. Sorry!

It's also worth noting that you can just toss cloud-flare in front of it to get HTTPS.

+1 for Netlify, and their amazing customer service via chat.

Reply on news.ycombinator.com