Does anyone know if github is planning to support https for custom domains?
Not as yet. Check out https://www.aerobatic.com
HTTPS for GitHub Pages
31–40 of 102 posts
Re: HTTPS for GitHub Pages
#32If I understand it correctly, the same HTTPS certificate is used for all GitHub pages websites. So hypothetically, I could do a MITM attack and redirect a user from an HTTPS protected GitHub pages site to my malicious GitHub Pages site right? (although the url would be different... but could be similar)
You don't have access to their private key. The fact that it is the same certificate is irrelevant. Anything you can do now, you could also do if they'd use separate certificates per subdomain.
Re: HTTPS for GitHub Pages
#33Does anyone know if github is planning to support https for custom domains?
"HTTPS is not supported for GitHub Pages using custom domains"[1] which is annoying.
[1]: https://help.github.com/articles/securing-your-github-pages-...
Re: HTTPS for GitHub Pages
#34What's the best way to get HTTPS for custom domains? Letsencrypt or Cloudflare? I don't think those are encrypted end to end, no?
Let's Encrypt is a certificate authority and provides certificates and so it would be end-to-end. However, CloudFlare is not end-to-end unless the server already supports HTTPS.
I wouldn't call CloudFlare end-to-end encrypted. They see the plaintext, independent of whether communication with the backend is encrypted or not.
Re: HTTPS for GitHub Pages
#35Does anyone know if github is planning to support https for custom domains?
Not until Fastly (Github's CDN) makes it possible.
Re: HTTPS for GitHub Pages
#36What's the best way to get HTTPS for custom domains? Letsencrypt or Cloudflare? I don't think those are encrypted end to end, no?
Not for GitHub, but GitLab does support HTTPS for custom domains by letting you upload your own SSL keypair. I use mine with Let's Encrypt.
Re: HTTPS for GitHub Pages
#37Re: HTTPS for GitHub Pages
#38What's the best way to get HTTPS for custom domains? Letsencrypt or Cloudflare? I don't think those are encrypted end to end, no?
Let's Encrypt is a certificate authority and provides certificates and so it would be end-to-end. However, CloudFlare is not end-to-end unless the server already supports HTTPS.
CloudFlare has a detailed explanation of the various options[1].
[1] https://support.cloudflare.com/hc/en-us/articles/200170416-W...
Re: HTTPS for GitHub Pages
#39Re: HTTPS for GitHub Pages
#40What's the best way to get HTTPS for custom domains? Letsencrypt or Cloudflare? I don't think those are encrypted end to end, no?
Cloudflare wouldn't be e2e in the sense that the SSL would terminate at Cloudflare, which would then open a new SSL connection to GitHub. Everything would be properly encrypted, but Cloudflare would indeed have access to the plaintext (i.e. it isn't e2e).
This isn't necessarily true. For example when you want to direct example.com to example.github.io Akami (serving for Github) will serve the certificate for *.github.io. Because this certificate is obviously invalid for the request you have to disable certificate validation in Cloudflare.
So client to Cloudflare is well protected but Cloudflare to Akami is vulnerable to MITM.
(And according to this new news Akami to Github is properly protected now)