There's a _loooooong_ discussion over at https://github.community/t5/GitHub-Page…s/Does-GitHub-Pages-Support-HTTPS-for-www-and-subdomains/td-p/7116 about this — incorrectly marked as "solved," of course.

When setting a custom domain on a GitHub Pages repo to a root domain, like example.com, a Let's Encrypt certificate for it is generated when Enforce HTTPS is enabled (obviously). But there is absolutely no way to have www.example.com redirect to the root/apex domain example.com with a valid SSL certificate as well.

It absolutely sucks having to add yet another service into the mix just to get https://www.example.com to redirect to https://example.com without showing a certificate warning. It seems like a pretty safe assumption that if someone enters an apex domain then they'll want www to mirror it/redirect to it — wanting different content at @ and www is a super rare edge case (and probably accidental if it does occur, to be honest).

Certain domain registrars and/or DNS providers can do this for free (Google Domains, Cloudflare, etc.) but I'd love to keep things consistent re: hosting...and, of course, my personal DNS provider and many others charge extra for this.

Please add www as an alt name on the LE certificate by default if the user inputs an apex domain as the custom domain!