Is there any news on this topic? Or at least a confirmation that one day github will protect "example.com" and "www.example.com" via ssl?
I will be a +1 on that request.
Just bought a .dev domain and was planning on keep it on github as a cv page, but since it needs an SSL cert (.dev rules) now I can't access it from the www subdomain. Not that I actively use it or share the url with it, but it's good to have the option. Right now the visitor will receive a cert error.
I understand not generating * certs to avoid abuse, but a www is pretty default and should be generated together with the apex domain when the repository is configured to a apex, since it's the same thing.
Not a real solution, but using Google Domains for my .dev domain I created a "Synthetic Record" subdomain forward to send www to the apex domain as a temporary redirect, preserving the path and enabling SSL. At first it barked that it wouldn't work because the certificate didn't exist yet, but within a short time it worked.
Again inelegant, but at least prevents scary browser security messages.
This worked for me as well – accidentally submitted a job app with the www link and 'bout **bleep** myself when they said my "website was down".