Security · Checked once per domain
SSL/TLS configuration graded A or A+What it checks and how to fix it
What it checks
Connects with every protocol from SSL 3.0 to TLS 1.3, enumerates the cipher suites the server accepts and inspects the certificate chain and HSTS header, then grades the configuration the way SSL Labs does. A or A+ passes, A- gets a warning, and B or below fails, with the specific issues listed (legacy protocols, weak or non-forward-secret ciphers, incomplete chain, small keys, missing TLS 1.3 or HSTS).
Why it matters
The grade sums up whether connections to your site can be downgraded, decrypted later or impersonated. Weak protocols and ciphers expose visitors to known attacks (POODLE, BEAST, Sweet32, Logjam), and an incomplete certificate chain makes some browsers and most API clients refuse to connect. Customers, auditors and security questionnaires increasingly ask for an A.
How to fix it
Use a modern protocol and cipher configuration, send the full certificate chain, and add HSTS. The Mozilla SSL Configuration Generator produces a tested config for your server; the "intermediate" profile below scores A, and HSTS takes it to A+.
nginx
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
ssl_prefer_server_ciphers off;
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;
Apache
SSLProtocol -all +TLSv1.2 +TLSv1.3
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305
SSLHonorCipherOrder off
Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"
Cloudflare: SSL/TLS → Edge Certificates → set Minimum TLS Version to 1.2, turn on TLS 1.3, and enable HSTS. Cloudflare's edge ciphers already grade A.
Rails / Kamal / Heroku: TLS ends at the proxy or load balancer in front of the app (kamal-proxy, a cloud load balancer), so configure it there; in Rails, config.force_ssl = true adds HSTS.