SSL Certificate Issues in Vibe-Coded Apps: HTTPS, Expiry & Trust Chain

Why SSL Problems Happen in AI-Generated Apps

SSL/TLS configuration sits below the application layer. AI coding tools like Bolt, Lovable, Cursor, and v0 generate code, not infrastructure. When they scaffold a Next.js app and you deploy it to Vercel, certificate management is handled automatically. The problems arise the moment you step outside the golden path: custom domains, staging environments, subdomains, self-hosted Node.js servers, or any backend that isn't a managed platform.

Sectigo's 2024 certificate outages overview says around 81% of companies have experienced a certificate-related outage in the past two years. For startups and indie developers, the equivalent is a "Your connection is not private" warning that silently destroys conversion rates before the founder notices. Expired certificates are entirely preventable with basic monitoring.

Common TLS misconfigurations include deprecated protocol versions and weak cipher suites with known vulnerabilities.

The Five SSL/TLS Issues to Check

An incomplete chain fails the same trust check as an untrusted CA, so it falls under SSL-003 too. VibeDoctor also warns when a certificate expires within 30 days (SSL-004). It does not test which TLS versions your server still accepts, so use SSL Labs (below) for that row.

HTTPS: Non-Negotiable in 2025

Modern browsers mark HTTP sites as "Not Secure" in the address bar. Google has used HTTPS as a ranking signal since 2014. Browser APIs that vibe-coded apps depend on - Service Workers, clipboard access, geolocation, camera - all require a secure context (HTTPS). Running a production application over plain HTTP in 2025 is not a risk tolerance question; it's a functional limitation.

// ❌ BAD - Express server started without TLS
// server.js - AI-generated, deployed to a bare VPS

import express from 'express';
const app = express();

app.get('/', (req, res) => res.send('Hello world'));

// This starts an HTTP server - no TLS at all.
// Anyone on the same network can read all traffic.
app.listen(3000, () => {
  console.log('Server running on port 3000');
});

// ✅ GOOD - Option A: Terminate TLS at a reverse proxy (recommended)
// Use Nginx or Caddy in front of your Node.js server.
// Caddy automatically provisions Let's Encrypt certificates:

// Caddyfile:
// your-domain.com {
//   reverse_proxy localhost:3000
// }
// That's the entire config - Caddy handles cert issuance and renewal.

// ✅ GOOD - Option B: Use a managed platform
// Deploy to Vercel, Netlify, Railway, or Render.
// All provision and auto-renew certificates for custom domains.
// Zero configuration required for HTTPS.

Certificate Expiry: The Preventable Outage

Let's Encrypt certificates are valid for 90 days by default (Let's Encrypt plans to cut that to 64 days in February 2027 and 45 days in February 2028). The short validity window is intentional - it encourages automation. When auto-renewal works, it's invisible. When it fails, your site goes down with a browser warning that looks like a security attack to your users.

Common reasons Let's Encrypt renewal fails on vibe-coded deployments:

• The DNS record was changed (new hosting, domain migration) and the ACME challenge can no longer reach the server
• The certbot cron job or systemd timer was never set up on a self-managed VPS
• Port 80 is firewalled, preventing the HTTP-01 challenge
• The certificate was issued for www.domain.com but the app now runs on domain.com (or vice versa)

// ✅ GOOD - Check your certificate expiry from the command line
// Run this to see when your cert expires:
// echo | openssl s_client -servername your-domain.com \
//   -connect your-domain.com:443 2>/dev/null \
//   | openssl x509 -noout -dates

// Output:
// notBefore=Jan 15 10:23:41 2026 GMT
// notAfter=Apr 15 10:23:41 2026 GMT

// For automated monitoring, set up a cron job or use
// a monitoring service like UptimeRobot (SSL monitoring
// is on its paid plans) to alert you 30 days before expiry.

TLS Protocol Versions: Deprecating TLS 1.0 and 1.1

TLS 1.0 and 1.1 are deprecated by the IETF (RFC 8996, 2021). The RFC's reasons: both depend on SHA-1 for handshake integrity and lack modern AEAD cipher suites. TLS 1.0's CBC mode is also exposed to the BEAST attack (RFC 7457). All major browsers removed support for TLS 1.0 and 1.1 by 2020. Servers that still accept TLS 1.0 fail security audits and fall short of PCI DSS, which required a move off SSL and early TLS by June 30, 2018.

If your app is deployed on Vercel or Netlify, TLS 1.0 and 1.1 are already disabled. Cloudflare is the exception: its default minimum TLS version is 1.0, so raise Minimum TLS Version to 1.2 in your zone's SSL/TLS settings. If you're running Nginx on a VPS - common for self-hosted Supabase, custom backend APIs, or staging servers scaffolded by Cursor - you need to verify your configuration:

# ❌ BAD - Nginx config accepting deprecated TLS versions
# /etc/nginx/sites-available/your-app

ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # TLS 1.0 and 1.1 are vulnerable

# ✅ GOOD - Nginx config with TLS 1.2 and 1.3 only
# /etc/nginx/sites-available/your-app

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256;
ssl_prefer_server_ciphers off;

# Add HSTS to enforce HTTPS at the browser level
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;

Incomplete Certificate Chains

An incomplete certificate chain occurs when your server sends only its end-entity certificate without the intermediate CA certificates needed to establish trust. Some browsers can complete the chain by fetching intermediate certificates from Authority Information Access (AIA) URLs, but many clients - especially mobile apps, API clients, and older browsers - cannot.

This manifests as connections that work in Chrome but fail in curl, mobile apps, or monitoring tools. The fix is to include the full chain (end-entity cert + intermediate CA cert) in your certificate bundle.

How to Audit Your SSL Configuration

Tools like VibeDoctor's Vibe Check check the live URL you scan: whether it serves HTTPS, whether the certificate is trusted and unexpired, and whether it expires within 30 days. It does not test which TLS versions or cipher suites your server accepts. Free to sign up.

For manual auditing, Qualys SSL Labs (ssllabs.com/ssltest/) provides a comprehensive free SSL/TLS report including protocol support, cipher suites, chain completeness, and an A/F letter grade. For expiry monitoring, UptimeRobot's paid plans include SSL monitoring that alerts you 30, 14, and 7 days before a certificate expires.

Trust can also be withdrawn from the certificate authority itself. In October 2026 browsers blocked eight eMudhra intermediate certificates whose private keys were tiny numbers anyone could work out. Read how to check whether the eMudhra case affects your certificate.

FAQ