---
title: X
description: Waiting minutes for a TLS grade, then puzzling over why you lost points, is the part of the classic SSL Labs test nobody enjoys. The new free SSL/TLS Grade…
canonical: https://watchfor.io/changelog/2026-09-01-ssl-grade-checker
---

[All updates](/changelog/page/6#2026-09-01-ssl-grade-checker) ✨ New Sep 1, 2026 · v 6.3.8

# New free tool: SSL/TLS Grade Checker

Waiting minutes for a TLS grade, then puzzling over why you lost points, is the part of the classic SSL Labs test nobody enjoys. The new free SSL/TLS Grade Checker grades any HTTPS server A+ to F in seconds (protocols, ciphers, forward secrecy, certificate trust, HSTS and even post-quantum key exchange), with the exact reason for every point. A faster, modern take on that test, with a live grade-distribution chart.

github.com, graded in seconds, with the reason behind every line.

## What it checks

Type a hostname and the checker connects the way a browser does, then tries what an attacker would try:

- every protocol version from SSL 3.0 to TLS 1.3

- weak cipher suites (RC4, 3DES, NULL, EXPORT) and whether connections get forward secrecy

- the certificate: trust chain, name match, expiry, key size and signature

- HSTS, OCSP stapling, CAA records, HTTP/2 and post-quantum key exchange

## How the grade works

The grade starts at A. The worst problem sets the cap, and only a clean setup is promoted to A+.

Finding Grade

Certificate not trusted, wrong name or expired T (not trusted)

SSL 3.0, an RSA key under 2048 bits, a SHA-1 signature, NULL/EXPORT/DES ciphers F at best

No TLS 1.2 or 1.3, or RC4/3DES accepted C at best

TLS 1.0 or 1.1 enabled, or no forward secrecy B at best

TLS 1.3, no old protocols or weak ciphers, forward secrecy, HSTS of 180 days or more A+

Every finding is listed with what it cost, so a B comes with the reason instead of a score to decode.

## Example

Your load balancer still accepts TLS 1.0 for a client nobody uses any more. The checker gives you a B and says why: TLS 1.0 and 1.1 are enabled. Turn them off, run it again, and you are at A. Add an HSTS header with a long max-age and it becomes A+.

## Keep watching it

A grade is a snapshot, and configs drift. To get the grade every day, with an alert when it drops, turn on Track TLS grade on an [SSL monitor](/docs/monitors/certificates#tls-grade). The checker itself is free at [/ssl-grade-checker](/ssl-grade-checker).

Share this update

---

Canonical page: https://watchfor.io/changelog/2026-09-01-ssl-grade-checker · Site guide: https://watchfor.io/llms.txt