Methodology · Open formula
SSL/TLS Grade methodology v1.2
Open formula: seven rows, 100 points, a letter from A+ to F.
1. Certificate validity — 30
- 30 — in force: started, not expired, the hostname in the SAN, more than 30 days left
- 20 — the same, with 30 days or fewer left
- 0 — expired, not yet valid, or issued for another name
2. Hostname — 10
- 10 — the requested name is in the SAN (Subject Alternative Name), matched the way browsers match it. The CN is not used, as in browsers since 2017; an IP address must be an IP entry of the SAN. *.example.com covers subdomains one level deep (www.example.com), not example.com itself and not a.b.example.com; the * stands only for the whole left-most label (f*.example.com covers nothing), never for an IP address, and needs at least two labels after it (*.com covers nothing; a public-suffix wildcard such as *.co.uk is not detected — CAs do not issue them); case and one trailing dot do not matter; a Cyrillic name is compared in its punycode form (xn--…), which is how the certificate carries it
3. Key strength — 15
- 15 — EC of 256 bits or more, or any key of 4096 bits or more
- 10 — from 2048 bits
- 0 — shorter
4. Protocol versions — 20
- 20 — TLS 1.3 accepted, TLS 1.0 and 1.1 refused
- 15 — TLS 1.2 accepted, TLS 1.0 and 1.1 refused
- 10 — TLS 1.2 accepted, and TLS 1.0 or 1.1 too
- 0 — otherwise (no TLS 1.2, and either no TLS 1.3 or legacy versions still on)
Each version is tried with its own handshake to the same address. Old versions are forbidden by RFC 8996.
5. Cipher — 10
- 10 — the negotiated cipher has 256 bits or more
- 7 — from 128 bits
- 0 — fewer
Forward secrecy and the cipher class (AEAD, CBC, RC4…) are shown on /ssl but are not scored.
6. Intermediate certificates — 5
- 5 — the server sent at least one certificate besides its own
Whether the chain leads to a trusted root is not verified: the probe connects without verification so that a site with a broken chain still gets a report.
7. HSTS — 10
- 10 — Strict-Transport-Security with max-age ≥ 31536000
- 5 — present with a shorter max-age
- 0 — absent, or the HTTPS request did not answer
Read from a HEAD request to https://{host}/ without following redirects.
Grade letter mapping
Expired or not yet valid → F whatever the sum
| Score | Grade |
|---|---|
| 95–100 | A+ |
| 85–94 | A |
| 70–84 | B |
| 55–69 | C |
| 40–54 | D |
| 0–39 | F |
Shown on /ssl next to the grade but not part of it: OCSP revocation and stapling, Certificate Transparency, CAA, forward secrecy.
References
Versioning
Current version — v1.2, updated . Every change to the published formula — the weights or their description — is a new version with a line in the changelog above.
Calculator
Set the certificate and the connection — the grade follows the same rules as the /ssl check.