Hacker News Reader

Comment by teolandon | Hacker News Reader

I'm hosting my webpage on GitHub Pages, with a custom domain. Back when I set it up, Let's Encrypt would not work with GitHub Pages so instead I simply put my page on Cloudflare. Should I spend the time and set it up again but with Let's Encrypt? I've heard people say bad stuff about Cloudflare, but dismissed it since my page is really just a blog.

View on HN

It doesn't really matter for a blog without auth, but when you are using cloudflare's https, the connection is not encryptes between CF and GitHub, so it's not end to end encrypted.

I recommend simply migrating even if you keep the DNS itself on cloudflare. It's a good exercise if nothing else.

It can be encrypted if you're using Full SSL on Cloudflare[1], but it's not authenticated, meaning anyone actively MITMing the connection between CF and GH could easily read and change the traffic. That said, it's not any script-kiddie who can MITM a connection between two DCs, so I think it's hardly a grave threat.

I think the only real gain is not allowing CF itself to see who is accessing your blog.

[1] https://support.cloudflare.com/hc/en-us/articles/200170416-W...

You can't use full ssl with let's encrypt, which is fundamentally incompatible with proxying.

But yes as I said it doesn't matter for a blog in practice.

You can't use full ssl with let's encrypt, which is fundamentally incompatible with producing.

I don't understand this statement, sorry.

Phone autocorrected :) I meant proxying.

Ah, ok. But how so? You can get a LE cert as long as you can serve a file in the correct URL, or set a certain DNS record. I don't see why proxying would prevent that.

Oh, of course. I was thinking of Let's Encrypt's DNS-based authentication since that's the only thing I use nowadays (though of course Github isn't using that). Ignore me.

It does work, I have a LE cert running behind cloudflare for Full SSL.

Open IP the cert you're using and see what other sites are listed on it. It probably includes a lot of sites that aren't yours. GitHub + Let's Encrypt gives you a clean cert for just your hostnames.

Just curious, why does that matter? It works and is secure, right?

Unless you personally have something against Cloudflare I'd say there's really no reason to bother changing anything.

But yeah, if you point your domain directly at GitHub Pages instead of at Cloudflare then GitHub should just issue you a cert and start using it automatically.

An interesting alternative is Fly.io - you can setup everything to go through them with a backend that's your Github Page and they'll spin out LE certs on the fly for it.

Reply on news.ycombinator.com