Can Ghost CMS issue a Let's Encrypt certificate for a custom domain when DNS A records resolve to the server but the public URL is set to a different hostname?

Ghost CMS’s `ghost setup ssl` command provisions Let’s Encrypt certificates only after the domain’s DNS A or CNAME record resolves to the Ghost instance; if the public `url` stored in config.production.json points to a different hostname, the certificate’s subject name will not match incoming requests.

When a reverse proxy terminates TLS, Ghost typically runs over HTTP and relies on forwarded headers, which can cause asset URLs and redirects to reference the wrong hostname, further complicating certificate validation.

Can Ghost issue a Let’s Encrypt certificate for a custom domain when DNS resolves to the server but the `url` config points elsewhere? Does the built‑in ACME HTTP‑01 challenge require the domain to resolve to the server, or can DNS‑01 be used instead? If the `url` value differs from the certificate’s CN, must `ghost setup ssl` be re‑executed to align them?