When Github enabled https for sites hosted on Github Pages, sites that were using custom domains went from redirecting https->http to giving certificate errors overnight. This happened to me. I didn't get a notification; the only way I found out what happened was by reading the Github blog. The blog post has a fix but it requires action by the site owner.

Strange, GitHub Pages should support TLS on custom domains: https://blog.github.com/2018-05-01-github-pages-custom-domai...

Looks like the site is using a wrong IP for the A record. It is 192.30.252.153, but should be 185.199.108.153, where Let's Encrypt is enabled.

If you want to use https with github and a custom domain you need to use either Cloudflare flexible SSL or with a domain host that allows ANAME or a flattened Cname... https://kolemcrae.com/Moving-To-GitPages/

You're right.

I looked into this a little further. The data is encrypted with Github's private key (thus decrypted with their public cert). I then wondered how he got a copy of Github's private key...but as it turns out, the IP does belong to Github.

In either event, definitely misconfigured, but I added an exception as it all seems legit in the end. It looks like he's just hosting his site (with his own DNS) on github's server and didn't get an ssl cert yet.

> The data is encrypted with Github's private key (thus decrypted with their public cert).

I don't think that's how it works, because then anyone could decrypt the data since the decryption key is public.

Rather, I think how asymmetric crypto works is you pass your public key to them so they can encrypt stuff with it and send it to you to decrypt with your private key. Then, to send stuff to them, you use their public key to encrypt the data for them so they can decrypt with their private key. That said, I think TLS works differently by using asymmetric crypto only to negotiate a symmetric key for the actual encryption of data.

EDIT: made wording more precise

disclaimer: i work for berkeley EECS, but have no association w/these faculty or class.

TL;DR: they probably wanted to save some money by not paying our instructional group to do the hosting, and instead are (most likely) paying github for hosting. because they're doing this themselves, it means that things like real, working SSL certs are their responsibility, and most likely were "too hard" or would take "too long" to set up properly.

¯\_(ツ)_/¯

Github is free for open source

point.

thanks for sharing... It's crazy that Berkeley (such an awesome institution) has come to this... The US/CA govt's owe it to the university to increase funding.

I really have my doubts that a university as big as Berkeley has any trouble with the costs of hosting video lectures. And afaik the UC's are also already very well funded

Weird, this shouldn't happen. If you set GitHub's certificate up correctly it should work. I'm assuming they never set up HTTPS at all, but someone linked to HTTPS here anyway?

shit like this makes me die a little bit on the inside.

>try to visit site >immediately get certificate warnings

hilarious

Whoever set this up should have taken Introduction to Web Security first

and web design

Link without https works: http://www.eecs189.org/