Building a fast, secured and free static site in less than three hours

Re:Building a fast, secured and free static site in less tha... by trextrex on Tuesday September 12, 2017 @07:50AM (#15226504)

As far as I know, Github pages doesn't support https for custom domains [1]. A better option for free hosting would be netlify, which supports Let's encrypt for custom domains.

[1] https://github.com/isaacs/github/issues/156

[ Parent | on HN ]

Re:Building a fast, secured and free static site in less tha... by paulgb on Tuesday September 12, 2017 @08:00AM (#15226542)

+1 for Netlify. It's like GitHub pages but with all the features you've ever wished it had.

[ Parent | on HN ]

Re:Building a fast, secured and free static site in less tha... by austenallred on Tuesday September 12, 2017 @07:53AM (#15226518)

We use cloudflare on our Github pages custom domain, so you can easily get https support that way.

[ Parent | on HN ]

Re:Building a fast, secured and free static site in less tha... by JorgeGT on Tuesday September 12, 2017 @07:56AM (#15226526)

It is exactly what the article author suggests in fact:

> Github pages does not offer secured custom domain name. The best way to get this feature for free is to use Cloudflare.

[The article then proceeds on how exactly do that.]

[ Parent | on HN ]

Re:Building a fast, secured and free static site in less tha... by trextrex on Tuesday September 12, 2017 @09:40AM (#15227170)

Yes, but cloudflare issues only shared certificates (that are shared across multiple domains) on their free plan [1]. If I wanted to use a dedicated certificate I'd have to upgrade to a paid plan.

[1] https://support.cloudflare.com/hc/en-us/articles/203349264-A...

[ Parent | on HN ]

Re:Building a fast, secured and free static site in less tha... by thesmallestcat on Tuesday September 12, 2017 @08:17AM (#15226638)

People need to stop calling Cloudflare's offering HTTPS support. It's snake oil.

[ Parent | on HN ]

Re:Building a fast, secured and free static site in less tha... by chrift on Tuesday September 12, 2017 @09:41AM (#15227180)

This is the first time I've heard such claims. Do you have any more details about this?

[ Parent | on HN ]

Re:Building a fast, secured and free static site in less tha... by sleepychu on Tuesday September 12, 2017 @11:05AM (#15227853)

    +------------------+               +------------------+             +-----------------------+
    |                  |               |                  |             |                       |
    |    CLIENT        | +---------->  |    CLOUDFLARE    | +---------> |       YOU             |
    |                  |     SSL       |                  |   NOT SSL   |                       |
    +------------------+               +------------------+             +-----------------------+

[ Parent | on HN ]

Re:Building a fast, secured and free static site in less tha... by ejcx on Tuesday September 12, 2017 @11:04AM (#15227846)

OP will undoubtedly not have more info. It's not snake-oil. I used to work there. There's a real TLS connection.

[ Parent | on HN ]

Re:Building a fast, secured and free static site in less tha... by orf on Tuesday September 12, 2017 @09:43AM (#15227197)

How so? Shared SSL cert is still an SSL cert. Not snake oil.

[ Parent | on HN ]

Re:Building a fast, secured and free static site in less tha... by dan1234 on Tuesday September 12, 2017 @08:32AM (#15226703)

But doing that won't protect the route between Cloudflare and Github pages, only the route between the user and Cloudflare.

[ Parent | on HN ]

Re:Building a fast, secured and free static site in less tha... by schrodinger on Tuesday September 12, 2017 @08:38AM (#15226757)

Wouldn't SSL via GitHub's cert protect that part?

[ Parent | on HN ]

Re:Building a fast, secured and free static site in less tha... by xxdesmus on Tuesday September 12, 2017 @09:05AM (#15226930)

Yes. It will.

[ Parent | on HN ]

Re:Building a fast, secured and free static site in less tha... by icebraining on Tuesday September 12, 2017 @09:55AM (#15227260)

Not really. They have two options for protecting the "back" connection: Full SSL and Full SSL (Strict).

Full SSL doesn't really protect you since Cloudflare won't check if the certificate is valid, an attacker could make their own self-signed cert and MITM you.

Full SSL (Strict) requires a valid cert for the domain being requested. If you had that, you wouldn't need Cloudflare in the first place.

[ Parent | on HN ]

Re:Building a fast, secured and free static site in less tha... by schrodinger on Tuesday September 12, 2017 @06:13PM (#15233406)

But the domain is github.com, which has a valid ssl cert. You only need cloudflare to get it on your own domain.

[ Parent | on HN ]

Re:Building a fast, secured and free static site in less tha... by icebraining on Wednesday September 13, 2017 @04:31AM (#15236497)

Right, but Cloudflare doesn't actually check if the cert is valid, unless you enable Strict mode, which you can't because you'd need Github to serve a cert for your own domain.

[ Parent | on HN ]

Re:Building a fast, secured and free static site in less tha... by schrodinger on Wednesday September 13, 2017 @11:45AM (#15239392)

Are you sure? Wouldn't it check to see that the cert is valid for github.com, not for your own domain, since that's the origin?

Edit: Looks like you're correct. Sorry!

[ Parent | on HN ]

Re:Building a fast, secured and free static site in less tha... by ic4l on Tuesday September 12, 2017 @07:56AM (#15226527)

It's also worth noting that you can just toss cloud-flare in front of it to get HTTPS.

[ Parent | on HN ]

Re:Building a fast, secured and free static site in less tha... by kaushalmodi on Tuesday September 12, 2017 @08:03AM (#15226561)

+1 for Netlify, and their amazing customer service via chat.

[ Parent | on HN ]