Cloudflare proxying prevents GH Pages certificate renewal

[alyssadai]

The way we have configured Cloudflare's DNS proxy - Full (strict) - is preventing GH pages from renewing the SSL certificates for our domains hosted on GH pages (?). At the moment, a workaround is to disable the proxy for our A records and CNAME record (for www) for neurobagel.org, wait until the renewal goes through, and then turn the proxy back on again.

One solution to avoid manual intervention might be the one outlined in https://gist.github.com/zbeekman/ac6eeb41ea7980f410959b13416d74c9?permalink_comment_id=3631135#gistcomment-3631135 or https://gist.github.com/zbeekman/ac6eeb41ea7980f410959b13416d74c9?permalink_comment_id=4977935#gistcomment-4977935 - that is, to use the Full encryption mode.

The GH docs themselves don't have much information on this issue as far as I can tell.

Relevant resources

• https://www.reddit.com/r/CloudFlare/comments/11tin1m/using_cloudflare_with_github_pages_and_ssltls/
• https://gist.github.com/zbeekman/ac6eeb41ea7980f410959b13416d74c9

Questions

• Does this also affect our services hosted using docker-nginx-acme?

Originally posted by @surchs in neurobagel/documentation#221 (comment)