--- title: Why we built our own SSL/TLS grade checker description: For over a decade, one free tool defined what a 'good' HTTPS setup looks like: the Qualys SSL Labs Server Test and its A+ to F grade. It's brilliant — and showing its age. Here's the short history of the SSL grade, what SSL Labs gets right, where it falls short in 2026, and why we built a faster, more modern grader of our own — including the post-quantum check SSL Labs doesn't have yet. canonical: https://watchfor.io/blog/ssl-grade-checker --- [All posts](/blog) [Security](/blog/category/security) Sep 01, 2026 · 5 min read · WatchFor Team # Why we built our own SSL/TLS grade checker For over a decade, one free tool defined what a 'good' HTTPS setup looks like: the Qualys SSL Labs Server Test and its A+ to F grade. It's brilliant — and showing its age. Here's the short history of the SSL grade, what SSL Labs gets right, where it falls short in 2026, and why we built a faster, more modern grader of our own — including the post-quantum check SSL Labs doesn't have yet. For more than a decade, one free tool has quietly defined what a "good" HTTPS configuration looks like. Paste a domain into the [Qualys SSL Labs SSL Server Test](https://www.ssllabs.com/ssltest/), wait a couple of minutes, and you get a single letter — A+ down to F — plus a wall of tables explaining it. That grade became shorthand across the whole industry: security teams put "must score A on SSL Labs" in their checklists, auditors asked for a screenshot of it, and a generation of engineers learned what forward secrecy was because SSL Labs docked them a point for not having it. We built our own. Not because SSL Labs is bad — it's excellent, and it earned its place — but because the world it was designed for isn't quite the world of 2026. This is the short history of the SSL grade, what the classic test still gets right, where it's starting to show its age, and why we decided to write a modern one. Try it first if you like: [WatchFor SSL/TLS Grade Checker](/ssl-grade-checker) . ## A short history of the SSL grade In the early 2010s, HTTPS was a mess. Servers happily negotiated SSL 3.0 and TLS 1.0, offered RC4 and 3DES ciphers, shipped incomplete certificate chains, and almost nobody had heard of forward secrecy. There was no easy way to know if your server was one of the bad ones — you'd need to understand cipher suite strings and run raw openssl s_client handshakes by hand. Ivan Ristić's SSL Labs test changed that. It did the hard handshakes for you and rolled everything up into a grade a non-expert could act on. Suddenly "we got a B, let's get to A" was a task a team could put on a sprint board. Attacks like POODLE (SSL 3.0), BEAST , FREAK and Logjam each arrived with a matching SSL Labs check, and the grade dropping was often how teams first learned they were exposed. The letter grade did something rare for security tooling: it made good configuration legible to people who weren't cryptographers. ## What SSL Labs still gets right Credit where it's due. The classic test remains the most thorough public TLS analyzer there is: - It probes an enormous matrix of protocol versions and cipher suites, including genuinely obscure legacy combinations. - It actively tests for named vulnerabilities (Heartbleed, ROBOT, Ticketbleed and friends) by performing the relevant handshakes, not just guessing from version numbers. - Its [Rating Guide](https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide) is public and precise, so the grade isn't a black box. - It's free, and it doesn't retain your results. If you want the deepest possible archaeological dig into a server's TLS stack, it's still the reference. ## Where it shows its age The test was designed in an era of long-lived servers and human operators. In 2026 a few things chafe: - It's slow. A full scan takes one to two minutes. That's fine once a quarter; it's painful when you're iterating on a config or checking a dozen hosts. - One vantage point, no API. You get a browser result from one location. There's no first-class API to script it, and nothing built for an AI agent to call. - The UI is from another decade. Dense tables, no shareable modern report, no dark mode. - It doesn't check the new things. TLS 1.3 changed the landscape, and 2026's frontier is post-quantum key exchange — the hybrid X25519MLKEM768 that protects today's traffic against "harvest now, decrypt later" attacks. Cloudflare and Google already negotiate it. The classic grade doesn't report whether you do. None of these are failures. They're just the difference between a tool built for 2013 and what an engineer reaches for today. ## Why we built our own We already run a global fleet of probes for [uptime and SSL monitoring](/ssl-monitoring) — real machines, in many regions, doing TLS handshakes all day. A grade checker was a natural thing to build on top of that, and building it ourselves let us fix exactly the things above: - Fast. A scan resolves in seconds, not minutes, because it runs on infrastructure that's already warm. - Modern checks. On top of the classic protocol/cipher/certificate analysis, we report TLS 1.3, post-quantum key exchange , HTTP/2, OCSP stapling, HSTS and CAA. - The reason for every point. The report leads with an ordered list of findings — worst first — so you see what to fix before you see the certificate serial number. The grading rules are transparent. - Built for automation too. It's the same probe engine behind our monitors, so the result is available programmatically, not just as a web page. For the genuinely broken-cipher checks — RC4, 3DES, EXPORT, NULL — we do the same thing the professional scanners do: because modern TLS libraries refuse to even offer those ciphers, we hand-craft the ClientHello messages ourselves and see which the server accepts. That's how our tool caught that google.com still accepts 3DES for old clients — a detail your browser hides from you. ## The grade scale Every scan returns one of these, with the exact reasons behind it: Grade Meaning What it says about the server 🟢 A+ Exceptional TLS 1.3, forward secrecy and HSTS, no legacy protocols or weak ciphers. The modern gold standard. 🟢 A Strong A solid, secure setup — usually one step from A+, often just missing HSTS or TLS 1.3. 🟡 B Adequate, with weaknesses Works, but has a real weakness: TLS 1.0/1.1 still enabled, or no forward secrecy. 🟠 C Weak configuration Accepts a weak cipher such as RC4 or 3DES. Old clients still connect insecurely. 🔴 T Not trusted The certificate isn't trusted — bad chain, expired, or hostname mismatch. Visitors see a browser warning. 🔴 F Insecure Something broken: SSL 3.0, a NULL/EXPORT cipher, a weak key, or a SHA-1 signature. ## How to get an A+ The report tells you precisely what's standing between your server and the top grade, but it's almost always some subset of: - Serve TLS 1.3 and 1.2 only — disable SSL 3.0 and TLS 1.0/1.1. - Offer only strong, forward-secret ciphers — remove RC4, 3DES, DES, EXPORT and NULL. - Serve a valid chain with a strong key — a complete certificate chain, RSA ≥ 2048 or ECDSA/Ed25519, no SHA-1. - Send HSTS — a Strict-Transport-Security header with max-age of at least 180 days. This is the single most common thing between an A and an A+. For extra credit in 2026: enable a TLS library or CDN that negotiates post-quantum key exchange . It costs you nothing and future-proofs today's traffic. ## Try it Grade any public HTTPS server in seconds: - [SSL/TLS Grade Checker](/ssl-grade-checker) — the tool this post is about. - [SSL Certificate Checker](/ssl-checker) — just the certificate: validity, expiry, SANs, chain. - [SSL & certificate monitoring](/ssl-monitoring) — get alerted before a certificate expires or a config regresses, instead of finding out from a customer. A grade is a snapshot. If it matters that your servers stay at an A+ — that a config change or an expiring certificate doesn't quietly drop you to a T — that's what continuous monitoring is for. [#ssl](/blog/tag/ssl)[#security](/blog/tag/security)[#certificates](/blog/tag/certificates)[#networking](/blog/tag/networking) ## Monitor your SSL/TLS certificates Get alerted well before certificates expire or a handshake breaks — checked from locations worldwide. [Learn more](/ssl-monitoring)[Start free](/auth/sign-up) Share this article --- Canonical page: https://watchfor.io/blog/ssl-grade-checker · Site guide: https://watchfor.io/llms.txt