SSL certificates for your custom domain

Every domain you point at Magic Pages gets a free SSL certificate. We request it, install it and renew it for you. There's nothing to buy, upload or configure.

That certificate is the padlock your visitors see in the address bar. It means the connection between their browser and your site is encrypted, so nobody in between can read or change what's sent.

How long it takes after you connect a domain

Usually a few minutes.

The certificate is requested the moment you add your domain, but it can only be issued once your DNS records actually point at us. So the waiting is almost always DNS, not the certificate. Most providers publish new records within minutes. A slow one can take a few hours, and in the worst case DNS changes need up to 48 hours to reach everyone.

While it's still provisioning, visitors to the new domain may get a browser warning. That's normal during setup, and it clears on its own once the certificate is issued.

Your .mymagic.page address is covered from the moment your site is created, so you have HTTPS before you connect a domain at all.

Renewal happens on its own

SSL certificates are short-lived by design. Yours is valid for about three months at a time, and it gets replaced well before it runs out. You'll never get an expiry warning, and there's nothing to renew or pay for.

If you click the padlock, you might notice your certificate was issued by a different authority than the last time you looked. That's fine. We use more than one, and which one signs your certificate can change when it's renewed. All of them are trusted by every mainstream browser.

Renewal only fails when something blocks it, and in practice that means a proxy sitting between your visitors and us. Why is my SSL certificate not getting renewed? covers the fix.

When you change or remove your domain

Changing your domain starts the process over for the new one. It gets its own certificate, with the same short wait once DNS points at us.

The old domain's certificate is removed along with the old domain, so anyone still visiting the old address will see a browser warning until they stop. Removing your domain works the same way, except your site switches back to your .mymagic.page address, which has a certificate already and keeps working straight away.

Neither one touches your content or your Ghost admin access.

If your site runs in a subdirectory

Subdirectory installs are the exception. Your own reverse proxy sits in front of your site, so the certificate your visitors see is the one on your server, and keeping it valid is your job. The certificate on the .mymagic.page address your proxy connects to is still ours.

When it looks like SSL is broken but isn't

Most reports of a broken certificate turn out to be something else. The two problems look different in the browser:

• A certificate problem stops the page loading. You get a full-page warning like "Your connection is not private", and you have to click through it to go any further.
• Mixed content lets the page load normally, but the padlock is missing, struck through, or replaced with "Not secure".

Mixed content is by far the more common of the two, and your certificate is working fine when it happens. The page itself is served over HTTPS, but something on it still loads over http://. It's usually an image, an embed or a script with a hard-coded http:// address, left behind by an import or pasted in from somewhere else.

To find it, open the browser console and reload the page:

• Chrome and Edge: press F12 (⌥⌘I on a Mac), open the Console tab, then reload.
• Firefox: press F12, open the Console tab, then reload.
• Safari: turn on the developer features under Settings → Advanced, then open Develop → Show JavaScript Console.

Each one shows up as a warning starting with "Mixed Content", followed by the exact address of the file causing it. That tells you what to fix:

• If it's in a post or page, edit it and change the http:// to https://. For an image, re-uploading it is easier, because Ghost then serves it from your own site.
• If it's in your theme, the address is hard-coded in the theme's files and needs a theme edit.

Once every file on the page loads over HTTPS, the padlock comes back.