You can’t do it with GitHub pages only (if you want to use a custom domain). I’m actually using free Cloudflare plan for terminating TLS connections.