0

On May 1, 2018, GitHub announced that GitHub Pages now gain support for HTTPS. It states that you're all set for this feature if you use CNAME or ALIAS records; or, updated DNS with new IP addresses for A records.

Then, you may Enforce HTTPS:

enter image description here

However, my Enforce HTTPS option is disabled, stating:

Unavailable for your site because a certificate has not yet been issued for your domain

Is this an automated process that takes GitHub time to complete; or, an action I am supposed to perform? From their Troubleshooting Custom Domains page, it states:

If you've chosen to use Certification Authority Authorization (CAA) records, at least one CAA record must exist with the value letsencrypt.org for your GitHub Pages site to be accessible over HTTPS. For more information, see "Certificate Authority Authorization (CAA)" in the Let's Encrypt documentation.

Does this mean I am supposed to create a new CAA DNS record?

What does this record need to contain for Let's Encrypt services used by GitHub? Or, do I use my own domain in this record, as in:

CAA Record: 0 issue caa.mydomain.tld

Improve this question

2 Answers 2

Reset to default
1

Strictly speaking, it's not necessary for you to verify that you have control of the parent namespace, i.e. the superior domain for which you have requested a TLS server certificate or to implement CAA.

Let's Encrypt will automatically issue the certificate via GitHub Pages automation as long as the common name in the signing request generated by GitHub resolves to the GitHub Pages server IP address. So, troubleshooting: is that the case? Is it working without Enforce HTTPS enabled?

The automation to request and issue the server certificate does entail a significant workload at scale, and so it is conceivable too as you suspected that there is simply a delay in issuance.

Improve this answer
1
  • Yes, http works - thanks, it's probably just latency then. I'll report back by accepting this answer.
    – Jason Sturges
    Jun 5, 2018 at 4:05
1

The Let's Encrypt bots at GitHub MUST see the GitHub IP addresses in order to create the certificate dynamically. Consequently, if you're using Cloudflare (or similar), you'll need to unproxy the CNAME's pointed to GitHub, so that the robots see GitHub IP's and not Cloudflare (or other) IP addresses.

Once the Let's Encrypt robots confirm that the route is pointed to their own infrastructure, then the certificate will be properly created and setup for that custom domain name.

Improve this answer
1
  • It turned out to be a GitHub issue - their support re-triggered the certificate and it worked immediately.
    – Jason Sturges
    Jul 1, 2021 at 18:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .