41–50 of 102 posts
Does anyone know if github is planning to support https for custom domains?
It's like GitHub pages on steroids and includes free Let's Encrypt based SSL for custom domains, can run builds from your GitHub repo with any static site generator, supports rewrite/redirect rules/proxying/form processing/password protection and much more...
If I understand it correctly, the same HTTPS certificate is used for all GitHub pages websites. So hypothetically, I could do a MITM attack and redirect a user from an HTTPS protected GitHub pages site to my malicious GitHub Pages site right? (although the url would be different... but could be similar)
You don't have access to their private key. The fact that it is the same certificate is irrelevant. Anything you can do now, you could also do if they'd use separate certificates per subdomain.
For those on Bitbucket, .bitbucket.io is the HTTPS equivalent of .bitbucket.org.
ICYI, you can also get free, self-renewing, wildcard SSL certs for custom domains on Bitbucket by using the Aerobatic add-on for Bitbucket. [ https://www.aerobatic.com ] disclaimer: co-founder of Aerobatic
2 sites, 1 domain, 5 deployments in a 24 hour period
something something Amazon US East
Earlier quoted context omitted.
Cloudflare's free plan includes one-click SSL for custom domains. That's what I use for my github pages sites.
Although it doesn't validate the backend certificate.
I haven't quite worked out the rules yet but some GH pages allow full TLS on CF (but not strict cert validation obviously) and some require flexible. I think org pages need flexible (plain HTTP) but project ones support HTTPS (if on a subdomain)?
This update may change all that so will need to experiment again. If it does break things then any new sites after the 15th may not be able to be made to work. If using a CF page rule or HSTS headers to permanently redirect to HTTPS then this could be a problem.
Earlier quoted context omitted.
Cloudflare wouldn't be e2e in the sense that the SSL would terminate at Cloudflare, which would then open a new SSL connection to GitHub. Everything would be properly encrypted, but Cloudflare would indeed have access to the plaintext (i.e. it isn't e2e).
This isn't necessarily true. For example when you want to direct example.com to example.github.io Akami (serving for Github) will serve the certificate for *.github.io. Because this certificate is obviously invalid for the request you have to disable certificate validation in Cloudflare. So client to Cloudflare is well protected but Cloudflare to Akami is vulnerable to MITM. (And according to this new news Akami to G…
CloudFlare appears to support this, but they actually don't. What they disingenuously call "Full SSL" is just "there has to be any SSL certificate, but we don't event check with a CA." It's completely MITM sensitive.
The only level higher than that is "Full SSL (strict)", which immediately requires a cert valid for the request host available on the origin, as you mention.
Ideally, they'd have an option in between: "Fuller SSL" (or just stop lying about their current options). Require a valid SSL certificate on the origin, for the origin, not for the request host. This way Cloudflare would ask Akamai for the *.github.io cert, and the browser would ask CloudFlare for the custom domain cert.
Yay, tears.
Does anyone know if github is planning to support https for custom domains?
Currently, they don't have plans. just use cloudflare.
Earlier quoted context omitted.
Cloudflare's free plan includes one-click SSL for custom domains. That's what I use for my github pages sites.
Although it doesn't validate the backend certificate.
https://support.cloudflare.com/hc/en-us/articles/200170416-W...
Just be sure to delete your CNAME file, based on a recent Github behavior change.
Does anyone know if github is planning to support https for custom domains?
Check out https://www.netlify.com (disclaimer, I'm a co-founder). It's like GitHub pages on steroids and includes free Let's Encrypt based SSL for custom domains, can run builds from your GitHub repo with any static site generator, supports rewrite/redirect rules/proxying/form processing/password protection and much more...