SSL/TLS diagnostics

How SSLConf assesses an SSL/TLS server.

The Server Test is a repeatable configuration review of a public TLS endpoint. It is designed to make the grade, evidence and limits visible, not to replace a full security assessment.

Run SSL/TLS Server Test

Scoring model

Every scan starts at 100. Confirmed configuration issues subtract points. A hostname mismatch is reported as M and an untrusted chain as T, rather than presenting either as a normal letter grade.

Grade bands

A+

100

A

85–99

B

70–84

C

55–69

D

40–54

E

25–39

F

0–24

M

Hostname mismatch

T

Untrusted chain

Point deductions currently applied

Untrusted certificate chain

−60, reported as T

Certificate expires in 7 days or less

−25

Certificate expires in 30 days or less

−10

TLS 1.3 unavailable

−5

TLS 1.0 or TLS 1.1 enabled

−20 per protocol

Weak or legacy cipher negotiated

−15

Weak TLS 1.2 cipher suite accepted

−10

TLS compression enabled

−25

Client-initiated renegotiation accepted

−5

Weak ephemeral key exchange

−15

HSTS missing or max-age below 180 days

−5

Certificate confirmed revoked through OCSP

−80

Public endpoint coverage

The scanner resolves public IPv4 and IPv6 addresses and attempts a TLS handshake against each selected endpoint using the requested hostname as SNI. A completed endpoint with a weaker confirmed TLS posture can reduce the overall grade. An endpoint that times out or cannot complete a handshake is shown as unavailable coverage; it does not, by itself, reduce the score.

What the report checks

Certificate and trust

Hostname coverage, validity, public-key details, supplied chain and path validation against the available trust store.

Protocols and ciphers

TLS 1.0 through TLS 1.3 probes, negotiated ciphers, TLS 1.2 cipher enumeration and an indicative server-order check.

Transport behavior

TLS compression, secure and client-initiated renegotiation, TLS_FALLBACK_SCSV, session resumption, ALPN and negotiated key exchange details when observable.

HTTP, DNS and revocation signals

HTTP-to-HTTPS flow, HTTPS redirect behavior, HSTS, preload status, HTTP/2 through ALPN, CAA, OCSP stapling and OCSP revocation when the issuer data and responder permit it.

Indicative compatibility

A small set of current TLS client profiles. This is not an exhaustive simulation of browser or operating-system versions.

Signals that do not directly lower the score

SSLConf still reports these because they are useful configuration evidence or recommendations. Their absence alone does not lower the current numerical grade:

  • HTTP/2 availability
  • CAA records
  • OCSP stapling
  • HSTS preload status
  • redirect-chain length and HSTS on an HTTPS redirect
  • session resumption and TLS_FALLBACK_SCSV status when no explicit penalty applies

Scope and limitations

  • The result is a point-in-time observation from the scanner's network path. DNS, CDNs, geographic routing and load balancers can serve different configurations to other clients.
  • A failed probe means the scanner could not confirm that check in its time window. It is not automatically evidence that the server does not support the feature.
  • The test is not a web-application penetration test, a vulnerability scanner, a certificate-authority audit or an exhaustive client-compatibility simulator.
  • SSLConf uses its own transparent rules. A grade is not intended to be equivalent to an SSL Labs grade or another provider's assessment.
  • Use the evidence and recommendations as input to change control; test configuration changes in your own environment before production rollout.

Technical references