Ghost blog SSL certificate expired

ghost ssl certificate expired breaks the editor, member sign-in, and theme assets until the proxy serving Ghost—not Ghost's Node process alone—presents valid HTTPS.

Ghost(Pro) manages TLS for default *.ghost.io sites; custom domains still require correct DNS to Ghost's infrastructure.

Self-hosted Ghost behind nginx, Caddy, or Apache depends on your certbot or ACME automation. Ghost's config.production.json url must match the certificate SANs.

Prove TLS on the public blog URL, then restart Ghost only if config changed after renewal.

First response

Read config.production.json (url field) on the server. Compare with the browser hostname.

curl -vI https://GHOSTDOMAIN/ghost/ 2>&1 | grep -Ei 'expire|SSL certificate'

For Ghost(Pro), open Publication settings → Domains and confirm DNS still matches their target. Self-hosted: check certbot timers or Caddy logs.

Ghost(Pro) incidents need Publication Settings domain screenshots. Self-hosted incidents need proxy config paths on disk. Stripe and Mailgun dashboards often list callback hostnames that must be checked individually. List every hostname theme JSON references because auxiliary asset hosts expire independently from the main blog URL.

What this error means

Ghost listens on HTTP internally; visitors hit TLS on the reverse proxy. Expired certificates at nginx/Caddy cause Member sign-up and Stripe checkout failures before Ghost logs show application errors.

Ghost forces HTTPS when url uses https://; with expired TLS, redirect loops and admin iframe errors appear.

Newsletter image URLs and CDN helpers inherit the same hostname—fix one certificate for the whole publication.

Ghost serves HTTP behind a proxy for most installs. Readers see certificate dates on nginx, Caddy, or platform edges. Admin iframes fail when publication URL uses https and proxy TLS is expired. Analytics snippets loading from subdomains fail independently when those hosts miss renewal.

Common causes

Certbot renew succeeded but nginx ssl_certificate path not reloaded.

Caddy storage corruption blocking automatic renewal.

Ghost(Pro) custom domain DNS reverted to old host with expired cert.

www vs apex split: cert covers only one name.

Mailgun/Stripe webhooks unrelated but concurrent—do not confuse with TLS incident.

Newsletter tracking domains and CDN image hosts expire independently from the main blog hostname.

Confirm from the outside

OpenSSL

echo | openssl s_client -connect HOST:443 -servername HOST 2>/dev/null | openssl x509 -noout -dates -subject -issuer

Replace HOST with the public hostname users type.

How to read the output

Confirm SAN covers the exact url host in config; members subdomain if used must be included.

curl

curl -vI --connect-timeout 10 https://HOST/ 2>&1 | grep -Ei 'expire|SSL certificate|subject:|issuer:'

Self-hosted renewal

certbot renew --dry-run
sudo nginx -t && sudo systemctl reload nginx

Caddy users:

journalctl -u caddy -n 50 --no-pager

Ghost CLI:

ghost restart

curl member API routes and admin paths separately after openssl on the homepage hostname. Compare Ghost Publication domain screenshots with external notAfter because editorial teams often validate only the admin URL on office networks.

Fix checklist

1. Renew TLS on reverse proxy (certbot/Caddy/host panel).
2. Reload proxy; verify nginx -t passes.
3. Align config.production.json url with live hostname.
4. ghost restart if URL or env changed.
5. Test /ghost/, member login, and RSS fetch.
6. Purge any CDN in front of static assets.
7. Re-test Stripe and email link domains.
8. Add external TLS monitoring on publication URL.

Roll out and verify

Ghost's content API and membership flows cache URLs aggressively. After proxy TLS renewal, restart Ghost only when url or integration keys change—unnecessary restarts extend downtime during high-traffic publish windows.

Validate email newsletter links and RSS enclosures—they often use the same hostname as the admin URL. An expired cert breaks reader apps silently while the marketing homepage is never opened by monitors.

For Ghost(Pro), keep registrar credentials handy; custom domain validation can block on WHOIS privacy if Ghost cannot complete automated checks.

Stripe and donation gateways should be smoke-tested with a minimal transaction after TLS recovery because PCI scanning tools may have flagged the site during the outage.

Restart Ghost after URL config edits only. Re-test email signup flows and paid tiers. Ask editors to confirm reader comments and portals load on guest Wi-Fi before you close the incident.

Editorial calendars should delay major launches until mobile openssl checks pass; phone browsers surface TLS errors more harshly during live events. Ghost recommends systemd units for Node while proxies handle certificates; runbooks should name both service restarts explicitly. Theme assets compiled with absolute https URLs will keep failing until TLS is valid even after Ghost restarts. Membership tiers using Stripe Customer Portal rely on return URLs matching valid TLS hostnames—renew before billing day spikes. For teams running Ghost in Docker, bind mounts for certificates must update on the host volume nginx reads, not only inside the Ghost container. Email digest links cached by Gmail may reference old hostnames; communicate subscriber impact after large DNS moves. Compare Publication custom domain status nightly during migration weeks. Content teams syndicating to Apple News or AMP caches may not notice TLS failures until social traffic spikes—monitor both apex newsletter links and main blog simultaneously. LDAP or SSO bridges for staff writers may use different hostnames from readers; openssl each role-based URL. Marketing automation hooks that pull RSS feeds over https fail quietly when TLS expires, starving campaigns of posts even while Twitter cards look fine in preview tools. Photo essays hosted on subdomains need explicit openssl checks because themes often hotlink those hosts. Staff writers using desktop Ghost admin from corporate networks may reach the site through split DNS; confirm external visitors and internal staff test the same public hostname. Podcast players fetching enclosure URLs over https stop updating episodes when TLS fails even if the site homepage still loads from cache. Record proxy certificate paths in version control so rebuilds do not point at obsolete PEM directories. Queue a test newsletter after renewal because delivery providers log TLS failures separately from browser warnings.

Treat publication and staging subdomains as separate incident scopes when newsletters reference topics.example.com while the main site uses example.com. After proxy renewal, validate scheduled posts and social cards that cache Open Graph metadata because TLS recovery does not automatically refresh third-party scrapers holding outdated previews from the outage window. Confirm mobile Safari reader mode loads a fresh article before closing the bridge.

When to use automation

Certificate files on disk and green panels lie until a stranger's TLS handshake succeeds. Schedule live checks on the exact hostname shoppers or API clients resolve, including redirects and the certificate presented after your platform edge terminates the connection. Pair TLS notAfter with RDAP domain registration data so revalidation is not blocked by registrar billing.

Run a one-shot proof on /check, then add the production hostname to monitoring with alerts at 30, 14, 7, and 1 day thresholds. ssldays reads the live chain external users see—useful when shared hosting, PaaS edges, or CMS layers each claim TLS is fine.