it's using github pages for the main website i think so i'm not sure if it's possible to setup custom domain + custom ssl cert for it?

It's possible but not very straightforward. Reference for anyone else trying to setup ssl cert for github pages: https://www.jonathan-petitcolas.com/2017/01/13/using-https-w...

For a long time it wasn't, but it looks like GitHub are slowly rolling this out to people.

Given that Jenkins is pretty popular, you'd think that they'd be able to sort something out with GitHub to get bumped up the list for something along these lines.

There's always the Cloudfare option, but I've never felt that this was an ideal solution when HTTPS should be extremely straightforward for GitHub to set up on their pages.

Should be able to use CloudFlare and "flexible" SSL setup. CNAME at the apex pointing to GitHub pages.

Please don't do this. It gives the user the illusion that their connection is secure, but the connection between Cloudflare and the site is not secure. Arguably it's better to encrypt some of the route rather than none of it, but also giving people a false sense of security comes with its own drawbacks.

Actually "flexible" might not be needed, "full" without strict should work. Traffic is still over TLS, but a valid named certificate is not required.

I think the user mostly cares about his connection to anything outside his network (e.g. for public WiFis).

You should set it to "Full" instead. That will use TLS but won't verify the domain name in the certificate like it does in "Strict" mode so you can still use Github pages.

I've used cloudflare to do SSL for a custom github pages domain before.

whoops, great catch thanks. Hoping we can figure out a fix very soon...

I’m using netlify[1] to host my site and it supports tls on public domains - through let’s encrypt - and http2 out of the box.

[1]: https://www.netlify.com/

Huh, they're using Github pages. I thought if you set up a redirect - a C dns response - to whatever.github.io, that would soothe the ssl complaints in the browser.

Looking at the dns records, it looks like they didn't do this, and instead set up an A record.

I realized Github probably documents this, and found: https://help.github.com/articles/using-a-custom-domain-with-...

My suggestion would likely work for a www subdomain, but not for the apex domain.