Free tools Windows power users keep installed
One-click scans. No signup required.
Most Ghost SSL failures come from one of five configuration mismatches: the site URL is not set to https://, DNS points somewhere other than the server, port 80 is blocked for Let’s Encrypt validation, a reverse proxy sends the wrong X-Forwarded-Proto value, or certificate renewal is no longer running. Fix those in that order. Ghost’s supported self-hosting stack uses Ghost-CLI, NGINX and Let’s Encrypt, and ghost setup ssl should be run only after the public hostname resolves to the correct server.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What the SSL error is telling you
“Not secure,” an endless HTTP/HTTPS redirect, or a failed ghost setup ssl command usually indicates a problem outside Ghost’s editor and themes. HTTPS depends on several layers working together:
As an Amazon Associate I earn from qualifying purchases.
- DNS: the hostname must resolve publicly to the machine that will answer the ACME challenge.
- Firewall and ports: Let’s Encrypt’s HTTP-01 challenge requires inbound TCP port 80, while visitors need port 443 for HTTPS.
- Certificate issuance: an ACME client such as the one used by Ghost-CLI must complete validation and save the certificate.
- NGINX: the proxy must load the right certificate and pass the original protocol to Ghost.
- Ghost configuration: the canonical URL must include the
https://scheme and the exact public hostname. - Renewal: the scheduled ACME job must renew the certificate before it expires and NGINX must reload the renewed files.
Diagnose from the outside in: verify the URL and DNS, then issuance and port access, then proxy headers, and finally renewal.
1. Verify Ghost’s canonical URL and public DNS
Set the URL to the exact HTTPS hostname
From the Ghost installation directory, inspect the configured URL. It must be the complete public address, for example https://blog.example.com. A bare hostname, a value without a protocol, or an http:// value causes Ghost to generate incorrect links and can leave administrative traffic on HTTP. Ghost’s configuration documentation says: “If using SSL, always enter the URL with https://.”
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Correct the URL with Ghost-CLI if necessary, then restart Ghost using the normal service command for your installation. Do not put a certificate filename or an alternate hostname in the URL setting; the URL is the address readers use, not a path to key material.
Check both A and AAAA records
Resolve the hostname from a network outside the server. The IPv4 A record and, if present, the IPv6 AAAA record must lead to the same intended host. A stale AAAA record is a common failure: IPv6-capable certificate authorities may reach an old machine while your browser reaches the new IPv4 address. Remove the incorrect AAAA record or fix the IPv6 route before trying issuance again.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →DNS changes may take time to propagate according to the record’s TTL. Do not run repeated issuance attempts while some public resolvers still return the previous address.
Use a real hostname, not localhost or an IP address
Let’s Encrypt cannot provision a certificate for a Ghost installation that is running only locally or is addressed by a bare IP. A publicly delegated domain name is required. Test the hostname from an external connection rather than relying on a local hosts-file entry, which can hide a DNS mistake.
2. Use Ghost-CLI’s supported SSL setup
Run the command only after DNS works
For the recommended Ghost-CLI, NGINX and Let’s Encrypt stack, run this from the Ghost directory:
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
sudo ghost setup sslGhost-CLI uses acme.sh to request a Let’s Encrypt certificate and creates a secondary NGINX configuration for port 443. Certificates are stored under /etc/letsencrypt. The command cannot succeed if the hostname still resolves elsewhere, the server is inaccessible from the Internet, or another virtual host answers the challenge.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Fix “missing protocol” and related setup errors
If Ghost-CLI reports that the URL has no protocol, correct the canonical URL first and rerun the command. If it reports that the domain cannot be validated, continue with the DNS, port and proxy checks below rather than copying a certificate path from another hostname. A certificate issued for one name will not make a different Ghost hostname secure.
When a manual NGINX configuration is appropriate
Ghost-CLI is the least error-prone route for a standard installation. A manually maintained proxy is possible when a CDN, load balancer or multi-site NGINX design requires it, but you then own the certificate paths, headers, reloads and renewal hooks. Keep the Ghost upstream on its local port and terminate TLS at the intended edge proxy.
3. Stop HTTP-to-HTTPS redirect loops
Pass the original protocol to Ghost
When NGINX terminates TLS and proxies to Ghost over local HTTP, Ghost needs to know that the visitor originally used HTTPS. The essential location block is:
location / {
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $http_host;
proxy_pass http://127.0.0.1:2368;
}The critical line is proxy_set_header X-Forwarded-Proto $scheme;. If the proxy always sends http, Ghost believes every secure request is insecure and redirects it to HTTPS again. If the header is omitted or overwritten by another proxy, the result can be an infinite loop. Ghost’s troubleshooting guidance attributes this specific loop to an incorrectly set x-forwarded-proto header.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Validate and reload NGINX safely
- Edit the active server block, not an unused template.
- Run
sudo nginx -t. Do not reload if the test reports an error. - Reload after a successful test with
sudo systemctl reload nginx(or the service command used by your distribution). - Open the site in a private window and inspect the redirect chain. It should end at one HTTPS URL without alternating schemes.
Account for a CDN or load balancer
If TLS terminates at a CDN or load balancer, configure that service to preserve the client protocol and pass the equivalent forwarded-protocol header to the origin. Choose one intended origin route; mixing a CDN “flexible” mode with an origin that forces HTTPS can create a loop before Ghost is reached. Ensure the CDN’s origin hostname and NGINX virtual host match the public domain used for the certificate.
4. Make Let’s Encrypt validation reachable
HTTP-01 requires inbound port 80
For the HTTP-01 ACME challenge, Let’s Encrypt requires inbound TCP port 80. Allow that port through the cloud firewall, host firewall, router and any security group, and route it to the proxy serving the hostname. Port 443 alone is not enough for this challenge.
Keep port 80 available after issuance. Ordinary HTTP requests should receive a permanent redirect to HTTPS, while the ACME client must still be able to serve its challenge response. Let’s Encrypt recommends redirecting normal HTTP traffic to HTTPS.
Check the challenge path and virtual host
A different NGINX server block, web server, CDN rule or WAF can intercept /.well-known/acme-challenge/. Confirm that the hostname’s port-80 virtual host answers the request and does not require authentication, rewrite it to an unrelated application, or return a generic CDN page. Test from an external network; a successful request from the server itself does not prove that the certificate authority can reach it.
Use another challenge when port 80 cannot be opened
| Challenge | What it needs | When to choose it |
|---|---|---|
| HTTP-01 | Inbound TCP 80 serving a token at the hostname | Normal Ghost server with an Internet-facing NGINX proxy |
| DNS-01 | Publishing the required TXT record in authoritative DNS | Port 80 cannot be exposed or a wildcard certificate is needed |
| TLS-ALPN-01 | Control of the TLS endpoint on port 443 and ACME-client support | Port 80 is unavailable but direct TLS validation is possible |
Choose a method your ACME client and network actually support. DNS-01 adds the requirement that the client can create or you can manually publish the correct TXT record; a stale or split DNS zone will still fail validation.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Check outbound access
The ACME client also needs outbound HTTPS access to its service, and the server must be able to resolve authoritative DNS. A restrictive egress firewall or blocked DNS on port 53 can look like a certificate problem even when inbound port 80 is open.
5. Investigate DNS, CAA and proxy failures
Inspect CAA records
DNS Certification Authority Authorization records can explicitly restrict which certificate authorities may issue for a domain. If the domain or a parent domain has a CAA allow-list that omits Let’s Encrypt’s identifier, letsencrypt.org, issuance is denied. Review CAA records at every applicable level and either permit the intended authority or remove an obsolete restriction.
Recommended Free Tools
Look for split-horizon and stale records
- Query the hostname from multiple public resolvers and from an external machine.
- Compare IPv4 and IPv6 answers.
- Confirm that the authoritative DNS provider is the zone you are editing.
- Check that a parked domain, old VPS or previous hosting account is not answering one address.
A DNS proxy can also hide the origin response. Temporarily use the provider’s DNS-only mode while issuing, or configure the proxy to pass the ACME challenge unchanged. Re-enable proxying only after the certificate and origin routing are correct.
Read the exact ACME error
“Connection refused” usually points to a firewall or service listener. “Timeout” suggests routing, filtering or an unreachable address. A response from the wrong site indicates DNS or virtual-host selection. A CAA error is a DNS policy issue, not a Ghost application failure. Fix the stated layer before requesting another certificate.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.6. Repair certificate renewal instead of reissuing manually
Understand the renewal window
Let’s Encrypt certificates have a default 90-day lifetime; Let’s Encrypt has used 90-day certificates since its launch in 2015. Renewal must therefore be an automated, monitored service rather than an occasional manual task. Industry rules are scheduled to require a 47-day maximum lifetime from March 15, 2029, and Let’s Encrypt has announced plans for a 45-day maximum by February 2028. These changes make unattended renewal and alerting even more important.
Trace the complete renewal path
- Identify whether Ghost-CLI’s acme.sh job is scheduled by cron or systemd.
- Inspect the job definition and its logs for authentication, DNS, network or permission errors.
- Confirm that the renewed certificate files are written under the expected
/etc/letsencryptlocation. - Check NGINX’s active configuration to ensure it references those files, not an old copy in another directory.
- Run
sudo nginx -t, then reload NGINX so it begins serving the renewed certificate. - Inspect the certificate presented publicly on port 443 and verify its expiration date and hostname.
Renewal can succeed while visitors still receive an old certificate if NGINX was not reloaded or a CDN is serving a cached edge certificate. Conversely, NGINX may reload a file whose permissions prevent the ACME client from replacing it. Check the user, group and file access in the job logs.
Update an old Ghost-CLI installation
If the installation uses a very old Ghost-CLI, update it before spending time on repeated renewal attempts. Ghost documents that Ghost-CLI 1.2.0 and 1.3.0 included fixes and migrations for earlier Let’s Encrypt and NGINX renewal problems. Follow the supported upgrade procedure for your operating system, back up the configuration, and then recheck the scheduled job and certificate paths.
Monitor expiry proactively
Use an external certificate-expiry monitor that checks the public hostname, not just a file timestamp on the server. Alert well before expiry and include the hostname, issuer, expiration date and the endpoint that served the certificate. Monitoring should catch a failed renewal, a forgotten NGINX reload, an expired CDN certificate and an unexpected DNS change.
7. Match common symptoms to the fix
| Symptom | Likely cause | First action |
|---|---|---|
| Browser says “Not secure” | Expired, mismatched or untrusted certificate; page still loaded over HTTP | Inspect the public certificate hostname and expiry, then verify Ghost’s canonical URL uses HTTPS. |
ghost setup ssl cannot validate |
DNS points elsewhere, port 80 is blocked, or the wrong virtual host answers | Check A/AAAA records externally and permit HTTP-01 traffic to the correct proxy. |
| HTTP and HTTPS alternate forever | Incorrect X-Forwarded-Proto value or conflicting CDN/origin modes |
Pass $scheme and remove contradictory redirect rules. |
| Certificate expired after working previously | ACME scheduler failed, NGINX still serves an old file, or CDN renewal was missed | Inspect the scheduled job, logs, active certificate paths and public expiry. |
| Works on IPv4 but not IPv6 | AAAA record reaches an old or unconfigured server | Fix the IPv6 host or remove the incorrect AAAA record. |
| CAA-related issuance error | CAA policy excludes Let’s Encrypt | Review domain and parent-domain CAA records and permit letsencrypt.org if intended. |
8. Choose between self-hosting and managed operation
Self-hosting is appropriate when you need control of the VPS, NGINX, DNS, firewall and deployment process and are prepared to maintain them. The operational responsibility is continuous: you must patch the server, preserve port access, monitor renewal and recover from DNS or proxy changes.
A managed Ghost service handles SSL, updates, backups, security and performance for you, reducing the number of infrastructure layers you must operate. The trade-off is less control over the underlying server and proxy configuration. Compare the options on these practical questions:
| Decision point | Self-hosted Ghost | Managed Ghost hosting |
|---|---|---|
| Certificate renewal owner | You or your operations team | Hosting provider |
| NGINX and firewall changes | Direct control, with corresponding maintenance | Handled within the provider’s platform |
| Failure alerting | You must configure and respond to monitoring | Often included in the managed service’s operations |
| VPS and DNS access | Required for the standard stack | Usually abstracted from the site owner |
| Customization | Maximum control over proxy and server | Constrained by the platform’s supported settings |
If you keep self-hosting, document the domain, DNS provider, firewall rules, certificate paths, renewal scheduler and reload command. That runbook turns the next expiry or migration into a repeatable repair instead of an emergency.
Quick Recap
9. A repeatable recovery checklist
- Set Ghost’s canonical URL to the exact public hostname beginning with
https://. - Verify public A and AAAA records; correct or remove stale IPv6 destinations.
- Confirm the site is not local-only and is not being addressed by a bare IP.
- Allow inbound TCP 80 and 443 through every firewall and security group.
- Run
sudo ghost setup sslfrom the Ghost directory when using the supported stack. - If using custom NGINX, pass
X-Forwarded-Proto $scheme, preserveHost, test withsudo nginx -tand reload. - Ensure CDN or load-balancer TLS mode agrees with the origin’s redirect behavior.
- Check CAA records, challenge-path routing and ACME client outbound connectivity.
- Inspect the renewal scheduler, logs, certificate files and NGINX references.
- Reload NGINX after renewal and verify the certificate actually served on port 443.
- Set external expiry alerts before the certificate’s 90-day lifetime becomes an outage.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
