Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Free static websites with SSL for hackers

rolodato.com

Post reply on HN
Print view View original

11–20 of 36 posts

Re: Free static websites with SSL for hackers

#11

Post by tony101 »

7ewis wrote: post #4

You can use Full SSL on CloudFlare with GitHub Pages, which is end to end. https://blog.cloudflare.com/secure-and-fast-github-pages-wit...

End-to-end secure, but only against passive attacks. Cloudflare "Full SSL" (as opposed to "Strict SSL") does not verify the certificate presented by the origin server, so someone sitting between Cloudflare and your origin can still MITM the connection without detection. Strict SSL does not currently work with GitHub Pages, because "*.github.io" certs do not match custom domains.

https://www.cloudflare.com/ssl/

https://github.com/isaacs/github/issues/156#issuecomment-110...

Re: Free static websites with SSL for hackers

#12

Post by tony101 »

rolodato wrote: post #7
7ewis wrote: post #4

You can use Full SSL on CloudFlare with GitHub Pages, which is end to end. https://blog.cloudflare.com/secure-and-fast-github-pages-wit...

It is end to end but CloudFlare does not verify the identity of the origin server. The only equivalent option would be "Full SSL (Strict)", which is not free.

I believe Strict SSL is free on Cloudflare's side, but GitHub Pages does not work with it because it does not present a matching and valid certificate.

https://support.cloudflare.com/hc/en-us/articles/200170416-W...

Re: Free static websites with SSL for hackers

#13

Post by rolodato »

tony101 wrote: post #12
rolodato wrote: post #7

Earlier quoted context omitted.

It is end to end but CloudFlare does not verify the identity of the origin server. The only equivalent option would be "Full SSL (Strict)", which is not free.

I believe Strict SSL is free on Cloudflare's side, but GitHub Pages does not work with it because it does not present a matching and valid certificate. https://support.cloudflare.com/hc/en-us/articles/200170416-W...

I stand corrected :)

Re: Free static websites with SSL for hackers

#14

Post by prdonahue »

tony101 wrote: post #11
7ewis wrote: post #4

You can use Full SSL on CloudFlare with GitHub Pages, which is end to end. https://blog.cloudflare.com/secure-and-fast-github-pages-wit...

End-to-end secure, but only against passive attacks. Cloudflare "Full SSL" (as opposed to "Strict SSL") does not verify the certificate presented by the origin server, so someone sitting between Cloudflare and your origin can still MITM the connection without detection. Strict SSL does not currently work with GitHub Pages, because "*.github.io" certs do not match custom domains. https://www.cloudflare.com/ssl/ https:…

We're working on making Strict mode work better in such situations.

For example, if the origin server presents a certificate with a SAN for *.github.io and you have a CNAME to yourusername.github.io, this will (soon) validate as Strict.

Re: Free static websites with SSL for hackers

#15

Post by jgrahamc »

rolodato wrote: post #7
7ewis wrote: post #4

You can use Full SSL on CloudFlare with GitHub Pages, which is end to end. https://blog.cloudflare.com/secure-and-fast-github-pages-wit...

It is end to end but CloudFlare does not verify the identity of the origin server. The only equivalent option would be "Full SSL (Strict)", which is not free.

That is simply untrue. Full SSL (Strict) is available on all plan levels including free. There is no charge for it. In addition, if you don't have an SSL certificate on your origin we'll give you a cert for free as well: https://blog.cloudflare.com/cloudflare-ca-encryption-origin/

Re: Free static websites with SSL for hackers

#16

Post by andrewaylett »

Another option, similar to some of the top-level comments suggesting Cloudflare with GitHub pages, is to use Cloudflare's long-lived internal origin certificate on GitLab and Cloudflare's public externally-valid certificate for end-users.

Although I have to admit to not actually having set that up yet: it's on my to-do list for a personal site that's in-progress this week.

Re: Free static websites with SSL for hackers

#17

Post by Hasz »

fenollp wrote: post #2

I use Netlify which has the same qualities and requires less setup/attention. Am not affiliated with them.

A second vote for Netlify, it's incredibly easy to use. I'm not monitoring uptime, but have had zero issues so far.

I use it with Hugo, a static site generator. I believe Netlify has an easy SSL setup option, but it has been a while since I set it up.

Before, I used NearlyFreeSpeech, which was very low cost but not nearly as streamlined.

Re: Free static websites with SSL for hackers

#18

Post by superasn »

For static sites hosting on AWS S3 is super cheap, plus with Cloudfront CDN in front you can be sure your site is being delivered to the user by a server near him. It's not 100% free but still very cheap for static websites[1]

[1] https://medium.com/@sbuckpesch/setup-aws-s3-static-website-h...

Re: Free static websites with SSL for hackers

#19

Post by q3k »

Please don't teach people how to centralize the web around a service that isn't even supposed to be used for personal web pages [1].

[1] - "We offer Pages sites primarily as a showcase for personal and organizational projects." https://help.github.com/articles/github-corporate-terms-of-s...

Re: Free static websites with SSL for hackers

#20

Post by ReverseCold »

q3k wrote: post #19

Please don't teach people how to centralize the web around a service that isn't even supposed to be used for personal web pages [1]. [1] - "We offer Pages sites primarily as a showcase for personal and organizational projects." https://help.github.com/articles/github-corporate-terms-of-s...

He is explaining how to do this with GitLab Pages, not GitHub Pages (the ToS you linked to).

Other than that, yes, GitLab pages exists for the same reason.

Post reply on HN