TLS certificate renewal responsibility for self-hosted Ghost
0 reputation · 13 Oct 2021, 20:39 UTC
Self-hosted Ghost does not manage DNS records or TLS certificates. Domain resolution must complete via A, AAAA or CNAME records before requests reach the host, and certificate validation is handled outside core, typically by a reverse proxy in front of the Node.js process.
The operator must decide how certificate renewal is performed and how the proxy is reloaded, because Ghost provides no built-in guidance for ACME validation or renewal reliability. Managed hosting abstracts this, so the decision is specific to self-hosted deployments.
Which renewal model is assumed for a standard self-hosted deployment with Nginx or Caddy? Does Ghost core require specific proxy headers or server_name configuration to remain accessible after renewal? When does responsibility for port 80 accessibility for HTTP-01 challenges end with Ghost and begin with the proxy?
ghost