Can Ghost CMS issue a Let's Encrypt certificate for a custom domain when DNS A records resolve to the server but the public URL is set to a different hostname?

Short Answer

Ghost cannot issue a Let's Encrypt certificate when the public URL in config.production.json differs from the domain whose DNS A record points to the server. The built-in ghost setup ssl command uses HTTP-01 validation exclusively and requires the domain in the url config to resolve to the same Ghost instance.

How Ghost's SSL Setup Works

When you run ghost setup ssl, Ghost:

1. Reads the url from config.production.json
2. Requests a certificate for that exact hostname via Let's Encrypt's HTTP-01 challenge
3. Creates a temporary file at /var/www/ghost/content/.well-known/acme-challenge/
4. Expects Let's Encrypt to fetch that file at http://<url>/.well-known/acme-challenge/<token>

If DNS for that url does not resolve to your Ghost server, Let's Encrypt receives a connection error or a different response, and validation fails.

DNS-01 Is Not an Option

Ghost's ghost setup ssl does not support DNS-01 validation. The command is hardcoded to use the HTTP-01 flow through the ACME proxy. You would need to manually obtain a certificate using tools like certbot with DNS-01, then configure Ghost to use it—but this bypasses Ghost's automated renewal mechanism.

Required Fix

Align the url config with your custom domain before running SSL setup:

1. ghost config url https://your-custom-domain.com
2. Verify DNS A record points to your server's IP
3. ghost setup ssl

If using a reverse proxy, ensure X-Forwarded-Proto and X-Forwarded-Host headers are set so Ghost generates correct redirect URLs after TLS termination.

Verification Steps

• ghost config — check current url value
• dig your-domain.com +short — confirm IP matches Ghost server
• curl -I http://your-domain.com/.well-known/acme-challenge/ from outside the server — should return 404 (expected before SSL setup)