SSL Certificate Troubleshooting

SSL Certificate Issues on BlitzPress

BlitzPress uses acme.sh with Let’s Encrypt to automatically provision and renew SSL certificates. When SSL fails, it is almost always a DNS or port accessibility issue.

Prerequisite: DNS Must Point to Your Server

Let’s Encrypt validates domain ownership via HTTP challenge on port 80. Your domain’s A record must point to your BlitzPress server IP before requesting SSL.

dig +short YOUR_DOMAIN
# Should return your server IP

Check acme.sh Logs

View the SSL issuance log:

cat /root/.acme.sh/YOUR_DOMAIN/YOUR_DOMAIN.log

Or re-issue with debug output:

blitzpress ssl:install YOUR_DOMAIN --debug

Common Issues

Error	Cause	Fix
DNS problem: NXDOMAIN	Domain not pointed to server	Add A record pointing to server IP
Connection refused	Port 80 blocked by firewall	sudo ufw allow 80/tcp
Too many certificates	Rate limit hit (5 per week)	Wait 7 days or use staging endpoint
Invalid response	Cloudflare proxy intercepting	Pause Cloudflare or use DNS challenge

Cloudflare Proxy Conflicts

If you use Cloudflare with the orange cloud (proxy) enabled, the HTTP challenge may fail because Cloudflare intercepts the request. Solutions:

• Temporarily disable proxy — set DNS to grey cloud, issue cert, re-enable proxy
• Use Cloudflare’s origin certificate — install via BlitzPress panel, set SSL mode to Full (Strict)

Renewal Failures

Certificates renew automatically via cron. Check the cron job:

crontab -l | grep acme

Force a renewal:

blitzpress ssl:renew YOUR_DOMAIN

Manual Certificate Installation

If you have a certificate from another provider:

blitzpress ssl:custom YOUR_DOMAIN /path/to/cert.pem /path/to/key.pem