Hacker News Reader

Comment by Wonnk13 | Hacker News Reader

What's the best way to get HTTPS for custom domains? Letsencrypt or Cloudflare? I don't think those are encrypted end to end, no?

View on HN

Cloudflare wouldn't be e2e in the sense that the SSL would terminate at Cloudflare, which would then open a new SSL connection to GitHub. Everything would be properly encrypted, but Cloudflare would indeed have access to the plaintext (i.e. it isn't e2e).

This isn't necessarily true. For example when you want to direct example.com to example.github.io Akami (serving for Github) will serve the certificate for *.github.io. Because this certificate is obviously invalid for the request you have to disable certificate validation in Cloudflare.

So client to Cloudflare is well protected but Cloudflare to Akami is vulnerable to MITM.

(And according to this new news Akami to Github is properly protected now)

You're right. And it's a shame, because they're so close.

CloudFlare appears to support this, but they actually don't. What they disingenuously call "Full SSL" is just "there has to be any SSL certificate, but we don't event check with a CA." It's completely MITM sensitive.

The only level higher than that is "Full SSL (strict)", which immediately requires a cert valid for the request host available on the origin, as you mention.

Ideally, they'd have an option in between: "Fuller SSL" (or just stop lying about their current options). Require a valid SSL certificate on the origin, for the origin, not for the request host. This way Cloudflare would ask Akamai for the *.github.io cert, and the browser would ask CloudFlare for the custom domain cert.

Yay, tears.

Let's Encrypt is a certificate authority and provides certificates and so it would be end-to-end. However, CloudFlare is not end-to-end unless the server already supports HTTPS.

I wouldn't call CloudFlare end-to-end encrypted. They see the plaintext, independent of whether communication with the backend is encrypted or not.

CloudFlare has a detailed explanation of the various options[1].

[1] https://support.cloudflare.com/hc/en-us/articles/200170416-W...

> CloudFlare is not end-to-end unless the server already supports HTTPS.

That's literally what this article is about.

HTTPS isn't supported if you're using GH Pages with a custom domain.

Not for GitHub, but GitLab does support HTTPS for custom domains by letting you upload your own SSL keypair. I use mine with Let's Encrypt.

Reply on news.ycombinator.com