If a self-hosted Ghost blog says Not Secure, loops between HTTP and HTTPS, or cannot renew its certificate, check the whole delivery path rather than Ghost alone. The reliable sequence is: set Ghost’s public URL to https://, point every relevant DNS record at the correct server, run ghost setup ssl after public DNS works, pass the original protocol through any reverse proxy, allow Let’s Encrypt to reach port 80, and verify that automated renewal updates the certificate NGINX actually serves.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What SSL is doing in a self-hosted Ghost installation
SSL is the encryption layer used by HTTPS. In a typical Ghost-CLI installation, Ghost itself listens on an internal port, NGINX accepts connections from the internet, and Let’s Encrypt issues the certificate. Ghost-CLI uses acme.sh to request the certificate and creates an additional NGINX configuration for port 443. The certificate files are stored under /etc/letsencrypt.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →That arrangement has several separate failure points. Ghost can have the wrong canonical URL, DNS can send visitors or the certificate authority to another machine, NGINX can omit the protocol-forwarding header, a firewall can block the ACME challenge, or renewal can succeed without NGINX ever loading the renewed file. Browser warnings are therefore symptoms, not a diagnosis.
Before changing anything: establish the intended public endpoint
Write down the exact hostname visitors should use, such as blog.example.com, and the server that should answer for it. SSL issuance is tied to a hostname, not to a Ghost process or a private address.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
- The hostname must resolve publicly; a local-only name cannot be validated by Let’s Encrypt.
- Let’s Encrypt cannot issue a certificate for a bare IP address or for a Ghost installation running only on a local machine.
- Decide whether both the apex name and a
wwwname are needed. Every name visitors can use must either be covered by the certificate or redirected before users encounter a certificate mismatch. - Keep a shell session open on the server while testing, so you can inspect NGINX logs and reload the configuration without losing access.
1. Correct Ghost’s canonical URL and DNS
Set the URL to HTTPS, including the protocol
Ghost generates absolute links, feeds, canonical tags, admin links and some redirects from its configured URL. In the production configuration, set the value to the complete public address with the https:// scheme. Ghost’s configuration guidance is explicit: if SSL is used, always enter the URL with https://.
A value such as blog.example.com is incomplete, and http://blog.example.com tells Ghost that the unencrypted endpoint is canonical. Either can produce mixed-content warnings, incorrect links or admin requests that fall back to HTTP. Edit the production configuration in the Ghost installation directory, preserve valid JSON syntax, and restart Ghost using your normal Ghost-CLI service workflow.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Check A and AAAA records from outside the server
Verify the public DNS answer for the hostname, not merely the server’s local resolver. The A record should point to the intended IPv4 address. If an AAAA record exists, it must point to the same service over IPv6. A stale AAAA record is a frequent cause of apparently random failures: an IPv6-capable certificate authority or visitor may reach an old host while IPv4 users reach the new one. Remove an incorrect AAAA record or repair the IPv6 route before requesting a certificate.
DNS changes are not instantaneous. Wait for the old record’s TTL to expire, then test from an independent network. Do not run SSL setup while some public resolvers still direct the hostname to a different machine.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
2. Use the supported Ghost-CLI SSL setup
For the standard Ghost stack, change into the Ghost installation directory and run:
sudo ghost setup sslRun this only after the hostname resolves publicly to the server. Ghost-CLI requests a Let’s Encrypt certificate through acme.sh and writes the NGINX settings needed to serve HTTPS on port 443. If the command reports that the URL is missing a protocol, fix the canonical URL first and then run the command again.
Free tools Windows power users keep installed
One-click scans. No signup required.
Do not copy a certificate path belonging to another hostname into Ghost’s configuration. Certificate, private-key and NGINX server-name settings must refer to the same names. If you maintain several Ghost sites, confirm that the command is being run from the intended installation directory and that NGINX’s virtual host for that name is the one being edited.
What a successful setup should produce
- A certificate covering the requested hostname is present under the Let’s Encrypt directory.
- NGINX has a listener for HTTPS on TCP port 443 and a server name matching the blog’s hostname.
- HTTP requests are redirected to HTTPS instead of serving a second, unsecured copy of the site.
- Ghost continues to receive traffic on its internal listener, commonly through the NGINX proxy rather than directly from the internet.
3. Fix redirect loops caused by a reverse proxy
An infinite redirect usually means TLS is terminated at NGINX, a load balancer or a CDN, but Ghost is not told that the original request was HTTPS. Ghost sees HTTP from the internal proxy connection and redirects to HTTPS; the proxy repeats the same internal HTTP request, creating a loop.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
For a manually maintained NGINX proxy, the location block should preserve the original host and protocol. The essential pattern is:
location / {
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $http_host;
proxy_pass http://127.0.0.1:2368;
}The critical line is proxy_set_header X-Forwarded-Proto $scheme;. It tells Ghost whether the visitor connected with HTTP or HTTPS. If another proxy sits in front of NGINX, that layer must preserve equivalent semantics instead of overwriting the value with http.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteAfter editing, validate the configuration and reload NGINX:
sudo nginx -t
sudo systemctl reload nginxIf the test fails, do not reload. Correct the reported syntax or duplicate-server-name problem first. If the test passes but the loop remains, inspect every proxy hop, including a load balancer or CDN, and ensure the HTTPS listener forwards to the intended Ghost origin. A proxy that sends users to one origin while the certificate belongs to another can look like a Ghost redirect problem even when Ghost is healthy.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
4. Make ACME validation reachable
HTTP-01 requires inbound port 80
Let’s Encrypt’s HTTP-01 challenge requires inbound TCP port 80. During issuance or renewal, the certificate authority requests a well-known challenge URL over ordinary HTTP. Keep port 80 open to the NGINX instance serving the hostname, even if every normal visitor is redirected to HTTPS. A 301 redirect from HTTP to HTTPS is recommended for ordinary traffic; it does not remove the need to accept the challenge request.
Check all controls that can block port 80:
- Cloud firewall rules and the server’s local firewall must allow inbound TCP 80.
- The router or NAT gateway must forward port 80 to the correct machine.
- NGINX must have a server block for the requested hostname rather than another virtual host catching the challenge.
- A CDN or proxy must pass the challenge response through to the origin instead of substituting its own page.
The ACME client also needs outbound HTTPS access to the certificate authority. Authoritative DNS must remain reachable on port 53 so that DNS changes and lookups can be confirmed.
When port 80 cannot be exposed
HTTP-01 is not the only challenge method. DNS-01 proves control by publishing a required TXT record, and TLS-ALPN-01 proves control over a TLS endpoint. Use one only if your ACME client and network support it, and document who is responsible for creating DNS records or reserving the TLS-ALPN listener. Do not switch challenge types casually while leaving an old HTTP-01 job active; competing jobs can make failures difficult to interpret.
5. Diagnose DNS, CAA, proxy and firewall failures
Certificate issuance can fail while Ghost serves pages perfectly. Work through the external path in this order:
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
- Resolve the hostname from a network outside the server and record both A and AAAA answers.
- Request the HTTP challenge URL and confirm that the response comes from the intended NGINX virtual host, not a default site or an unrelated server.
- Check that port 80 is reachable from the public internet and that redirects do not hide a broken origin route.
- Inspect any CDN or reverse-proxy mode. TLS termination, origin encryption and host-header rewriting must all point to the certificate and Ghost site you intend to use.
- Review the exact ACME error. A timeout indicates routing or firewall trouble; a wrong-answer error usually indicates DNS or virtual-host selection; a CAA error requires checking policy records.
CAA records
Certification Authority Authorization records can restrict which certificate authorities may issue for a domain. Let’s Encrypt identifies its CA as letsencrypt.org. If a CAA record on the domain or a parent domain allows only other authorities, issuance is blocked until the policy is changed. A missing CAA record is not itself an error; an allow-list that omits Let’s Encrypt is.
6. Repair renewal instead of repeatedly issuing certificates
Let’s Encrypt certificates default to a 90-day lifetime. Renewal therefore belongs in an automated, monitored service, not in an occasional manual command. A certificate can expire even when the blog has not changed if the scheduled ACME job stopped, DNS moved, a firewall rule changed or NGINX continued serving an older file.
Verify the complete renewal chain
- Identify the scheduled task used by Ghost-CLI and acme.sh, whether it is a cron entry or a systemd timer. Confirm that it runs as the account and environment expected by the installation.
- Read the ACME and Ghost-CLI logs for recent attempts. Look for validation failures, permission errors, rate-limit responses and successful issuance times.
- Confirm that the renewed certificate and key paths match the files referenced by the active NGINX server block. A successful renewal is useless if NGINX still points to an old copy.
- Run
sudo nginx -t. If valid, reload NGINX so workers begin serving the renewed certificate. - Inspect the certificate presented publicly on port 443 and record its expiration date. Check the hostname and any alternate names as well as the date.
- Set an alert with enough lead time to investigate. Monitoring the public certificate catches both failed renewals and reloads that never happened.
Do not assume that replacing a file automatically changes the certificate in memory. NGINX workers normally need a reload, and a proxy or CDN may have its own certificate and cache. Test the endpoint that readers actually visit.
Upgrade an obsolete Ghost-CLI installation
If the installation uses a very old Ghost-CLI, update it before spending days on renewal symptoms. Ghost documents that Ghost-CLI versions 1.2.0 and 1.3.0 included fixes and migrations for earlier Let’s Encrypt and NGINX renewal problems. After updating, recheck the scheduled job, certificate paths and NGINX configuration rather than assuming an upgrade repaired every existing setting.
7. Match symptoms to likely causes
| Symptom | Likely layer | What to check first |
|---|---|---|
| Browser says Not Secure but the page loads | Canonical URL, certificate name or mixed content | Confirm Ghost uses https://, inspect the public certificate’s hostname and look for HTTP asset URLs. |
ghost setup ssl says the domain cannot be validated |
DNS, port 80 or virtual-host routing | Check A/AAAA records, inbound TCP 80 and the HTTP challenge response from an external network. |
| HTTP and HTTPS redirect forever | Reverse-proxy protocol header | Pass X-Forwarded-Proto $scheme through every proxy hop, then test and reload NGINX. |
| Only some visitors see errors | IPv6, stale DNS or a proxy edge | Compare A and AAAA answers and test the actual IPv4 and IPv6 paths. |
| Renewal logs show success but the old expiry remains online | Wrong NGINX path or missing reload | Compare the renewed file with the active server block and reload after nginx -t. |
| ACME reports a CAA problem | DNS policy | Inspect CAA records at the hostname and parent domain; allow letsencrypt.org if Let’s Encrypt is the intended authority. |
Certificate works on the apex name but not www |
Names covered or redirected | Ensure the certificate includes every public name or redirect the unused name before TLS negotiation. |
8. A repeatable maintenance checklist
Use this checklist after DNS changes, server migrations, proxy changes and every renewal-system update:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Ghost’s canonical URL is the exact public hostname with
https://. - A and AAAA records lead to the intended server, or an incorrect AAAA record has been removed.
- Port 80 reaches the correct NGINX virtual host and ordinary HTTP redirects to HTTPS.
- Port 443 serves the expected certificate and forwards to Ghost.
- The reverse proxy sends the original host and
X-Forwarded-Protovalue. - Let’s Encrypt’s challenge method is documented, and its required ports or DNS records are available.
- CAA policy, if present, permits the chosen certificate authority.
- The ACME scheduled task is running and its logs are reviewed.
- NGINX references the renewed files, passes
nginx -tand has been reloaded. - An external expiry monitor checks the public endpoint, not merely a file on disk.
Self-hosting versus managed Ghost operation
SSL is only one part of operating Ghost. Self-hosting gives you control over NGINX, DNS, firewall rules, certificate policy and the underlying server, but you also own renewal, monitoring, updates, backups, security and incident response. Ghost’s managed hosting service handles SSL and those operational tasks for customers who do not want to maintain them.
| Operating model | Who controls certificates and network changes | Who responds when renewal fails | Best fit |
|---|---|---|---|
| Self-hosted Ghost-CLI stack | Site owner or administrator controls Ghost-CLI, NGINX, DNS and firewall | The operator must inspect jobs, logs, paths and public expiry | Teams needing server-level control and willing to run an operations routine |
| Managed Ghost hosting | Hosting provider manages the platform’s SSL and infrastructure | Provider handles the underlying renewal and platform maintenance | Publishers who value reduced infrastructure work over low-level control |
What is changing about certificate lifetimes
Let’s Encrypt states that it has offered 90-day certificates since its launch in 2015. Industry rules are scheduled to require a 47-day maximum from March 15, 2029, and Let’s Encrypt plans a 45-day maximum by February 2028. These future limits make reliable automation and expiry monitoring more important, not less. A process that renews only when someone remembers to run a command will become increasingly fragile as the available renewal window shortens.
Quick Recap
Final verification after a repair
- Open the canonical HTTPS address in a private browser window.
- Follow an HTTP link to confirm it redirects once to HTTPS rather than looping.
- Open the Ghost admin address and verify that it remains on HTTPS.
- Check the certificate name and expiry presented on port 443.
- Test from both IPv4 and IPv6-capable networks when an AAAA record exists.
- Record the renewal task, certificate path, proxy configuration and alert destination so the next operator can repeat the checks.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
