SSL certificate is valid and auto-renews

An expired or self-signed SSL certificate triggers browser security warnings that block every user from accessing the site, destroying conversions and search engine trust simultaneously. CWE-295 and OWASP A02 both flag unvalidated certificates as a critical attack surface: a lapsed cert is trivially exploitable by any network-path attacker via downgrade or MITM. Most vibe-coded projects rely on hosting platforms for automatic provisioning, but custom server deployments or certbot misconfigurations can silently fail to renew, leaving the site offline on a Sunday at 3am.

Verify SSL validity and expiry before launch, then confirm automatic renewal is in place.

# Check certificate expiry
openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null | openssl x509 -noout -dates

For managed platforms (Vercel, Netlify, Fly.io, Railway, Render, Cloudflare), SSL is auto-provisioned and renewed — no action required beyond deploying with a configured domain. For self-managed servers, install Certbot with a daily renewal cron: certbot renew --quiet. For container deployments, use Caddy as a reverse proxy — it handles certificate lifecycle automatically.