TLS certificate renewal responsibility for self-hosted Ghost

In a self-hosted Ghost deployment, Ghost core does not manage TLS certificates. The responsibility for renewal and validation lies entirely with the reverse proxy (typically Nginx or Caddy) or an external tool like Certbot.

Ghost operates as a Node.js application usually listening on a local interface (default port 2368). It assumes that a reverse proxy handles SSL termination. Therefore, Ghost is not involved in ACME challenges (HTTP-01 or DNS-01), nor does it need to restart when a certificate is renewed.

Renewal Models by Proxy Type

• Caddy: This is the simplest model. Caddy handles ACME (Let's Encrypt/ZeroSSL) natively. It fetches, renews, and re-reloads its configuration automatically without manual intervention.
• Nginx + Certbot: This is the standard manual model. Certbot manages the renewal. For HTTP-01 challenges, Nginx must have access to port 80. You must configure a "hook" in Certbot to runnginx -s reload upon successful renewal to pick up the new certificates.

Configuration Requirements

To ensure Ghost remains accessible and secure after a renewal, the proxy must pass specific headers to Ghost. Ghost uses these to determine if the connection is secure and what the correct URL is.

# Example Nginx headers for Ghost
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;

Port 80 Responsibility Boundary

The responsibility for port 80 accessibility ends with Ghost and begins with the proxy. If you use the HTTP-01 challenge, the proxy must be configured to allow external traffic on port 80 to the .well-known/acme-challenge/ path. If the proxy is behind a firewall or load balancer, that infrastructure must also forward port 80 to the proxy instance.

Assumptions and Uncertainty

This guide assumes a standard Linux-based VPS deployment. If you are using Docker, the boundary remains the same, but the proxy container must map ports 80 and 443 to the host. It is uncertain whether you are using a DNS-01 challenge; if so, port 80 accessibility is not required for the renewal process.