Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HTTPS for GitHub Pages

github.com

Post reply on HN
Print view View original

21–30 of 102 posts

Re: HTTPS for GitHub Pages

#21

Post by Nullabillity »

nileshtrivedi wrote: post #16
davis_m wrote: post #7

Earlier quoted context omitted.

I would hope not. If Github could generate valid SSL certs for random domains, something would be very broken.

It would just request LetsEncrypt to generate those certs and then prove the "ownership" (more like "control") of those domains by whatever method LetsEncrypt wants (.well-known perhaps?).

Yup, .well-known should be pretty simple for them to implement.

Re: HTTPS for GitHub Pages

#23

Post by donut2d »

Wonnk13 wrote: post #22

What's the best way to get HTTPS for custom domains? Letsencrypt or Cloudflare? I don't think those are encrypted end to end, no?

Let's Encrypt is a certificate authority and provides certificates and so it would be end-to-end. However, CloudFlare is not end-to-end unless the server already supports HTTPS.

Re: HTTPS for GitHub Pages

#25

Post by nothrabannosir »

donut2d wrote: post #23
Wonnk13 wrote: post #22

What's the best way to get HTTPS for custom domains? Letsencrypt or Cloudflare? I don't think those are encrypted end to end, no?

Let's Encrypt is a certificate authority and provides certificates and so it would be end-to-end. However, CloudFlare is not end-to-end unless the server already supports HTTPS.

> CloudFlare is not end-to-end unless the server already supports HTTPS.

That's literally what this article is about.

Re: HTTPS for GitHub Pages

#27

Post by nothrabannosir »

Wonnk13 wrote: post #22

What's the best way to get HTTPS for custom domains? Letsencrypt or Cloudflare? I don't think those are encrypted end to end, no?

Cloudflare wouldn't be e2e in the sense that the SSL would terminate at Cloudflare, which would then open a new SSL connection to GitHub. Everything would be properly encrypted, but Cloudflare would indeed have access to the plaintext (i.e. it isn't e2e).

Re: HTTPS for GitHub Pages

#28

Post by r3bl »

grep4master wrote: post #10
r3bl wrote: post #3

About damn time! I "cheated" the system by having a script that will redirect you to the HTTPS version if you click on anything from the HTTP protocol, which kind of accomplishes forcing the HTTPS encryption, but not really. Then I've decided to switch to my own domain and just use CloudFlare (+ whitelisting Tor). Now I'm kind of thinking about switching to GitLab Pages since they pretty much kick the hell out of Git…

Are you sure that's not a Gitlab EE-only feature?

Yes, I am: https://pages.gitlab.io/

It's a feature they introduced pretty recently (~ a month ago IIRC), but it always kind of worked with CI + some tinkering (I know this because my organization used our own instance of GitLab as our publishing platform before this feature became a thing).

Re: HTTPS for GitHub Pages

#29

Post by Snappy »

grep4master wrote: post #10
r3bl wrote: post #3

About damn time! I "cheated" the system by having a script that will redirect you to the HTTPS version if you click on anything from the HTTP protocol, which kind of accomplishes forcing the HTTPS encryption, but not really. Then I've decided to switch to my own domain and just use CloudFlare (+ whitelisting Tor). Now I'm kind of thinking about switching to GitLab Pages since they pretty much kick the hell out of Git…

Are you sure that's not a Gitlab EE-only feature?

Yes, it's a GitLab EE-only feature, but it's also available for free on GitLab.com, which is running GitLab EE.

Re: HTTPS for GitHub Pages

#30

Post by calebm »

If I understand it correctly, the same HTTPS certificate is used for all GitHub pages websites. So hypothetically, I could do a MITM attack and redirect a user from an HTTPS protected GitHub pages site to my malicious GitHub Pages site right? (although the url would be different... but could be similar)
Post reply on HN