TLS Security Score Simulator
Select your TLS configuration options and see your security score update in real time. Identify gaps and get specific recommendations.
TLS Configuration
Security Features
What a TLS Grade Actually Measures
When a scanner like Qualys SSL Labs grades a server, it is not measuring one thing — it is auditing a negotiation. Every TLS connection begins with the client and server agreeing on a protocol version, a key-exchange method, and a cipher suite, and the server's job is to only agree to combinations that are still considered safe. A grade summarises how much dangerous ground your server is still willing to concede to an old or malicious client.
That is why grading is dominated by caps rather than points. Offering TLS 1.0 does not subtract a little from an otherwise perfect score — it caps the whole grade, because an active attacker can force a downgrade to the weakest option both sides support. The same logic applies to weak ciphers: it does not matter that AES-256-GCM is first in your list if RC4 is still last in it. This simulator mirrors that behaviour so you can see which single toggle moves your score the most.
The good news is that modern defaults do almost all the work. TLS 1.3 (RFC 8446) removed every legacy cipher, made forward secrecy mandatory, and cut the handshake to one round trip. A server running TLS 1.3 + a hardened TLS 1.2, an ECDHE-only cipher list, a 2048-bit or ECDSA certificate, and an HSTS header will score an A on essentially every grader in use today.
Raising Your Grade: The Config That Matters
nginx: ssl_protocols TLSv1.2 TLSv1.3; — Apache: SSLProtocol -all +TLSv1.2 +TLSv1.3. Both legacy versions were formally deprecated by RFC 8996 in 2021 and are blocked by all major browsers.
Use the Mozilla SSL Configuration Generator’s "intermediate" profile as a baseline. Any suite starting with ECDHE- provides forward secrecy; anything with RC4, 3DES, CBC-SHA, NULL, or EXPORT should not appear at all.
Strict-Transport-Security: max-age=31536000; includeSubDomains — start with a short max-age (e.g. 86400) during rollout, then raise it. Add the preload token and submit to hstspreload.org only when every subdomain serves HTTPS.
nginx: ssl_stapling on; ssl_stapling_verify on; with a resolver directive. This removes the browser’s round trip to the CA and keeps visitor IPs out of CA logs.
Config files describe intent; the network is truth. Test what is actually negotiated: openssl s_client -connect example.com:443 -tls1_1 should FAIL, and our TLS Checker should show only 1.2/1.3 accepted.
Frequently Asked Questions
Simulations Are Nice — Live Checks Are Better
CertNotify continuously checks your real TLS configuration and certificate expiry, and alerts you the moment something weakens or approaches its deadline.