Finally sorted out my SSL issues — after almost an hour. (Not Ghost’s fault, just exposed by Ghost.) The fix:

  • upgrade acme.sh
  • find and update a defunct server location in a per-site config

No one who doesn’t do this stuff for a living would ever have been able to fix this.