News for hackers. Stuff that matters.

A comment on Life Is About to Get Harder for Websites Without HTTPS. Parent comment

Re:Life Is About to Get Harder for Websites Without HTTPS by Santosh83 on Wednesday July 12, 2017 @02:11AM (#14750476)
It is, unless you want to use a custom domain with it. With the latter case your only choice to retain some semblance of HTTPS is to put it behind a CDN, but that still breaks end-to-end HTTPS. The problem really has to solved at Github's end, by allowing users to upload their own certs.
[ Parent | on HN ]
Re:Life Is About to Get Harder for Websites Without HTTPS by agrajag on Wednesday July 12, 2017 @03:11AM (#14750697)
You can set your own cert on the CDN though, and have the CDN request origin objects over https from the github domain. Since the CDN is the endpoint for your domain, you'll still be presenting a custom domain to your users.
[ Parent | on HN ]
Re:Life Is About to Get Harder for Websites Without HTTPS by icebraining on Wednesday July 12, 2017 @05:19AM (#14751150)
Which CDNs support that kind of domain translation?
[ Parent | on HN ]
Re:Life Is About to Get Harder for Websites Without HTTPS by teraflop on Wednesday July 12, 2017 @02:21AM (#14750516)
Wait, how is serving your content through Github's servers using your own certificate any more secure than letting GitHub or CloudFlare provide the cert?
[ Parent | on HN ]
Re:Life Is About to Get Harder for Websites Without HTTPS by IanCal on Wednesday July 12, 2017 @03:46AM (#14750846)
It's arguably more secure than letting cloudflare do it (adding a new party doesn't make the chain more secure) but it doesn't have to be more secure than using githubs cert. It's just that you can't use githubs cert with your own custom domain.
[ Parent | on HN ]