1

I am hosting my personal webpage on GitHub Pages with a custom domain and using CloudFlare for DNS etc. I am using the Full (Strict) mode for TLS/SSL and Proxied DNS. When The GitHub Pages tries to renew, it is already expired and CloudFlare cannot connect to the Origin server due to the invalid (expired certificate). Since a connection to Origin cannot be established, GitHub cannot renew its certificate.

Ways to solve this MANUALLY is to either use TLS/SSL Flexible (haven't tried it but I presume it would work, since it doesn't require TLS between Origin and CloudFlare), or disable the Proxied DNS, becoming DNS Only, until GitHub Pages renews its certificate and then re-enable Proxied DNS.

Any suggestions on how to solve this permanently? It's frustrating to have to manually do this every 3 months.

Thanks in advance!

EDIT: I have found this: https://gist.github.com/zbeekman/ac6eeb41ea7980f410959b13416d74c9

But, even if the GitHub Pages' certificate weren't expired, it still wouldn't work, since GitHub checks that the DNS servers are pointed to the GitHub Pages addresses. Any workarounds?

Improve this question
2
  • 1
    What is the reasoning behind using CloudFlare Proxied DNS at all? GitHub Pages already runs on a premium CDN (Fastly).
    – Maximillian Laumeister ♦
    Mar 17 at 6:16
  • 1
    Granted, I don't serve much content at the moment, since it is mainly to reserve the domain for the future, but not have it parked for GoDaddy to run adds :P , but CloudFlare provides granular caching settings, Rules (which I am already using), etc.. GitHub Pages doesn't offer all that.
    – ARGYROU MINAS
    Mar 17 at 6:23

1 Answer 1

Reset to default
1

If you use CloudFlare for your registrar, you can get your certificate through them. Then it will always be able to renew. You can still use full/strict mode to yourdomain.github.io and GitHub pages can manage that certificate themselves.

This ensures that:

  • Your end users get a valid certificate
  • Cloudflare still manages your DNS
  • Your connection to your origin is always encrypted
  • Github can always renew the certificate since they are renewing for yourdomain.github.io which they control
  • You don't have to do anything on a periodic basis
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.