---
title: Why is my SSL grade a B? How to test it with the SSL/TLS Grade checker
description: A customer's security questionnaire asks for an A, and your site scores a B. To test your SSL/TLS grade, scan which protocol versions and ciphers the server accepts, check the certificate, and look for HSTS. Here's how to do it in seconds with the free SSL/TLS Grade checker, how the A+ to F grade is built, and the exact settings that took a real B to an A.
canonical: https://watchfor.io/blog/how-to-test-your-ssl-tls-grade
---

# Why is my SSL grade a B? How to test it with the SSL/TLS Grade checker

2026-10-04 · WatchFor Team · Guides · guides, ssl, security

A customer's security questionnaire asks for an A, and your site scores a B. To test your SSL/TLS grade, scan which protocol versions and ciphers the server accepts, check the certificate, and look for HSTS. Here's how to do it in seconds with the free SSL/TLS Grade checker, how the A+ to F grade is built, and the exact settings that took a real B to an A.

To test your SSL/TLS grade, scan the server's HTTPS setup the way a grader
does: which protocol versions it accepts (TLS 1.0 to 1.3), whether any weak
cipher still works, whether connections get forward secrecy, whether the
certificate is trusted, and whether HSTS is on. The worst finding caps the
grade. The most common reason for a **B** is that TLS 1.0 and 1.1 are still
enabled.

The free [SSL/TLS Grade](/ssl-grade-checker) checker runs that scan from a
WatchFor probe and returns an A+ to F grade with every finding behind it,
worst first. No signup.

## What this tool answers

*How good is this server's TLS configuration, and what exactly keeps it
from the top grade?* Reach for it when a security questionnaire or a
customer asks for your SSL Labs-style grade, after changing a load balancer
or CDN TLS policy, before a compliance audit, or when a scanner report says
"weak TLS configuration" without saying what. The grade is transparent: it
starts at A, each problem caps it, and the findings list says which one won.

## A real example

### Testing an SSL/TLS grade that comes back as B

The typical case: a site behind a CDN, valid certificate, TLS 1.3, and still
a B. We tested a site set up exactly like that: `example.com`, which is
served through Cloudflare.

In the [SSL/TLS Grade](/ssl-grade-checker) checker we entered
`example.com`, kept port **443** and pressed **Grade this server**. The
scan took 99 ms from the Vilnius probe:

![The SSL/TLS Grade result for example.com: grade B, adequate with weaknesses, with TLS 1.3, post-quantum and HTTP/2 chips; the first findings are an amber "Obsolete TLS versions enabled: TLS 1.0/1.1 are deprecated. Serve TLS 1.2 and 1.3 only.", a blue "HSTS not enabled: Add Strict-Transport-Security to force HTTPS and qualify for A+." and a green "Certificate is valid and trusted"](/blog/how-to-test-your-ssl-tls-grade-result.webp)

Grade **B**, "adequate, with weaknesses". Almost everything is in good shape:
a trusted ECDSA certificate (83 days left), TLS 1.3, no weak ciphers, forward
secrecy, OCSP stapling, HTTP/2, even post-quantum key exchange
(`X25519MLKEM768`). Two findings sit above the good news:

![The protocols and hardening sections of the same result: TLS 1.3 and TLS 1.2 in green, TLS 1.1 and TLS 1.0 in red, SSL 3.0 struck through; cipher TLS_AES_128_GCM_SHA256, key exchange X25519MLKEM768 (post-quantum), forward secrecy yes, weak ciphers none; HSTS not enabled, OCSP stapling yes, CAA record none](/blog/how-to-test-your-ssl-tls-grade-protocols.webp)

1. **TLS 1.0 and 1.1 accepted** (red in the protocol row). That alone caps
   the grade at **B**. Both versions were formally deprecated in 2021
   (RFC 8996), and current browsers no longer use them by default.
2. **No HSTS.** It doesn't lower the grade, but A+ requires it.

**The answer:** the B is one setting. Cloudflare's default minimum TLS
version is 1.0. Raise it and the grade goes to **A**; add HSTS with a
`max-age` of at least 180 days and it becomes **A+**. Where to change it:

| Where TLS ends | Setting |
| --- | --- |
| Cloudflare | SSL/TLS → Edge Certificates → **Minimum TLS Version** → TLS 1.2 |
| nginx | `ssl_protocols TLSv1.2 TLSv1.3;` |
| Apache | `SSLProtocol -all +TLSv1.2 +TLSv1.3` |
| AWS ALB | A security policy without TLS 1.0/1.1, e.g. one of the `ELBSecurityPolicy-TLS13-1-2-*` policies |

Then send `Strict-Transport-Security: max-age=31536000` (one year) and
re-run the grade. Before switching old versions off, check that nothing you
depend on still needs them: old embedded devices, payment terminals or
legacy API clients.

## How to read the results

| What you see | What it means |
| --- | --- |
| **Grade** | A+, A (green), B, C (amber) or F (red). An untrusted certificate is an F labelled "Not trusted": a certificate problem overrides everything else. |
| **Chips** | The highest protocol version, post-quantum key exchange and HTTP/2 when present. |
| **Findings** | Worst first: red critical, amber warning, blue information, green good. The first red or amber finding is what to fix. |
| **Protocols** | Every version tested. Green accepted and secure, red accepted but obsolete, struck through not accepted. |
| **Key exchange & cipher** | What a modern client negotiated, whether it has forward secrecy, and any weak ciphers (RC4, 3DES, DES, EXPORT, NULL) the server still accepts. |
| **Hardening** | HSTS and its max-age, OCSP stapling, a CAA DNS record, post-quantum key exchange. |
| **Certificate** | Subject, issuer, trust, expiry, key type and size, signature algorithm, Certificate Transparency SCTs, SANs. |

How the grade is built:

| Finding | Effect |
| --- | --- |
| Certificate untrusted, wrong name or expired | **F** (not trusted) |
| RSA key under 2048 bits, SHA-1/MD5 signature, SSL 3.0, NULL/EXPORT/DES ciphers | capped at **F** |
| No TLS 1.2 or 1.3, or RC4/3DES accepted | capped at **C** |
| TLS 1.0/1.1 enabled, or no forward secrecy | capped at **B** |
| TLS 1.3, no TLS 1.0/1.1, no weak ciphers, forward secrecy, HSTS ≥ 180 days | **A+** |

OCSP stapling, CAA, HTTP/2 and post-quantum are reported as positives but
don't change the letter.

## More ways to use it

- **Answering a questionnaire.** Send the grade together with the protocol
  row; reviewers usually care about "no TLS 1.0/1.1" more than the letter.
- **After changing a TLS policy.** Re-run it right after switching a load
  balancer or CDN policy to confirm the old versions are really gone.
- **Mail and other ports.** Put `465` or `993` in **Port** to grade
  implicit-TLS mail servers.
- **Comparing hostnames.** The apex and `www` can sit on different front
  ends with different settings; grade both.
- **Proving a single fact.** For just the protocol versions, the
  [TLS version guide](/blog/how-to-check-tls-versions) shows how to document
  that 1.0 and 1.1 are off.

## Tips and gotchas

- **Grades differ between tools.** Each grader has its own rules. This one
  is documented above; the history and the differences from SSL Labs are in
  [Why we built our own SSL/TLS grade checker](/blog/ssl-grade-checker).
- **HSTS is read from one HTTPS request** to the host. If your homepage
  redirects, the header has to be on that first response.
- **One location, one front end.** Behind anycast or GeoDNS, other regions
  may hit servers with a different TLS policy.
- **A T is not a weak config.** It means browsers will refuse the
  certificate. Fix that first; the
  [SSL certificate guide](/blog/how-to-check-an-ssl-certificate) shows how
  to find out why.
- **Your own openssl may refuse old versions.** OpenSSL 3 disables TLS 1.0
  and 1.1 at its default security level, so a quick test from your laptop
  can say "no protocols available" even when the server accepts them. Use
  the command below.

## Check it from the command line too

Force an old protocol version, lowering OpenSSL's own security level so your
client is willing to try:

```bash
echo | openssl s_client -connect example.com:443 -servername example.com \
  -tls1_1 -cipher 'DEFAULT:@SECLEVEL=0' 2>/dev/null | grep -E '^ +(Protocol|Cipher) +:'
```

```text
    Protocol  : TLSv1.1
    Cipher    : ECDHE-RSA-AES128-SHA
```

A handshake completed: the server accepts TLS 1.1. Repeat with `-tls1` for
TLS 1.0 (same result here). A server with the old versions off answers with
`tlsv1 alert protocol version` instead. And the missing HSTS header:

```bash
curl -sI https://example.com/ | grep -ic strict-transport
```

```text
0
```

## Keep watching it

A TLS policy can regress with any load balancer or CDN change. An
[SSL monitor](/ssl-monitoring), on plans that include the TLS grade, runs
the same scan once every 24 hours and shows the grade with its findings;
switch on the **TLS Grade** alert rule and pick the lowest grade you accept,
and an incident opens with the scan that finds the drop. **Check now**
rescans immediately after you change something.

## FAQ

**How do I check my SSL grade?**
Run your hostname through an SSL/TLS grade checker such as the free one
above or Qualys SSL Labs. Both test protocol versions, ciphers and the
certificate and return a letter with the reasons.

**Why is my SSL Labs grade capped at B?**
Usually because TLS 1.0 or 1.1 is still enabled, or because connections
don't get forward secrecy. Set the minimum protocol to TLS 1.2 and prefer
ECDHE or TLS 1.3 cipher suites.

**How do I get an A+ SSL rating?**
Accept only TLS 1.2 and 1.3 with TLS 1.3 enabled, offer no weak ciphers,
keep forward secrecy, use a trusted certificate, and send HSTS with a
`max-age` of at least 180 days. What changed between the versions is in
[TLS 1.2 vs 1.3](/blog/tls-1-2-vs-1-3).

---

Canonical page: https://watchfor.io/blog/how-to-test-your-ssl-tls-grade · All articles: https://watchfor.io/blog/all.md · Site guide: https://watchfor.io/llms.txt