SSL Grader
Not just "is the certificate valid?" but "is the whole TLS setup current?" This page probes each protocol version separately, reads the certificate's key and signature, checks forward secrecy and HSTS, and turns the result into a letter grade — with every deduction explained, so a B or C tells you exactly what to fix.
Want this watched continuously? Monitor this free with myeventwatch — expiry and downtime alerts, no card required.
What the grade measures
A certificate check answers whether one document is valid. A setup can pass that check and still be weak: a server that answers TLS 1.0 for anyone who asks, a cipher that lets a future key compromise decrypt today's recorded traffic, a missing HSTS header that leaves the first visit downgradable. The grader therefore measures four things, each with its own section in the result. The protocol matrix performs one handshake pinned to each of TLS 1.0, 1.1, 1.2 and 1.3 — a version counts as supported only if a handshake pinned to it actually completes, so "supported" is measured, not inferred from whatever version happened to negotiate. The certificate section reports what the server presents even when it fails validation: issuer, covered names, validity window, key type and size, and signature algorithm. Forward secrecy is read off the negotiated cipher: TLS 1.3 suites are forward-secret by construction, older suites only when they use ephemeral key exchange. And HSTS is read from the domain's root response, with its max-age and flags.
One deliberate omission: OCSP stapling is not checked. The TLS library this service uses does not expose stapled responses, so the grader cannot observe them and says so, rather than guessing. Stapling neither helps nor hurts the grade; if it matters to you, check it with openssl from your own machine. The grade rubric itself is written out below, in full, because a grade you cannot audit is just a badge.
The rubric, in plain language
Every site starts at A+, and deductions cap the grade — the worst applicable cap wins, and each one appears as a finding in the result. F means browsers reject the site or there is no usable TLS: an expired certificate, a self-signed certificate, a certificate that does not cover the hostname, an MD5 signature, or no successful handshake on port 443 at all. C means obsolete or untrusted: a chain that does not validate (usually a missing intermediate), a weak key (RSA below 2048 bits, or a small elliptic curve), a SHA-1 signature, or a highest supported protocol of TLS 1.1 or older. B means a real but survivable weakness: a legacy protocol still enabled alongside current ones, or a negotiated cipher without forward secrecy. A means one soft issue: no HSTS header, an HSTS max-age below six months, or a certificate inside its 30-day renewal window. Fix the findings in order — F and C first, then B, then A — and re-grade after each change; the hour-long cache means you may want to wait before re-checking a fix. Under the hood, the page calls GET /api/check/ssl-grade on sysosx's server, which runs the probes and caches the grade for an hour.
Related tools: SSL checker for the quick certificate view and expiry countdown, website health check for reachability, certificate, expiry and records together, HTTP status chain when the TLS setup is fine but the redirect path is not, and port scanner for what else is listening on the host besides port 443. For what has ever been issued for the domain rather than what it presents today, use the Certificate Transparency search.
Further reading: how TLS grades are earned and lost — the common failures behind each cap and the fixes for them, in the order worth doing.
Frequently asked questions
How is this different from the SSL checker?
The SSL checker answers one question: what certificate does this server present, and is it valid? The grader audits the whole TLS setup: which protocol versions the server still offers (TLS 1.0 through 1.3, each probed separately), whether the negotiated cipher gives forward secrecy, the certificate's key size and signature algorithm, and whether HSTS is set. Use the checker for a quick expiry countdown; use the grader when you want to know whether the setup itself is current.
What does each grade mean?
A+ is a clean result: current protocols only, forward secrecy, a valid chain covering this hostname, and long-lived HSTS. A means one soft issue, usually missing or short HSTS, or a certificate inside its 30-day renewal window. B means a real but survivable weakness: a legacy protocol still enabled, or a cipher without forward secrecy. C means something obsolete or untrusted: a chain that does not validate, a weak key or SHA-1 signature, or a highest protocol of TLS 1.1 or older. F means browsers reject the site or there is no usable TLS at all: an expired, self-signed or mismatched certificate, or an MD5 signature.
Why is a server capped at B just for supporting TLS 1.0?
Because "supported" is a fact about the server, not about your visitors. Nothing current negotiates TLS 1.0, so keeping it enabled buys no compatibility and keeps the weakest ciphers on offer. The cap is the grader refusing to call a setup current while a protocol from 1999 is still answering. Disabling it is usually one configuration line, and the grade recovers immediately.
Why does the grader not check OCSP stapling?
Honest limitation, stated on the page: the TLS library this service uses does not expose stapled OCSP responses, so the grader cannot observe them. Rather than guess, it reports stapling as "not checked" and lets it neither help nor hurt the grade. If stapling matters to you, check it with openssl s_client -connect host:443 -status from your own machine.
Why is the result cached for an hour?
A grade changes only when the server's TLS setup changes, which is rare and deliberate — unlike DNS propagation, where the answer is the point. Fresh checks are limited per visitor (about twenty an hour, with a short burst allowance) like the other server-side checks, and a cached result is labelled as such. If you just fixed something, wait out the hour or re-check with a fresh result after the cache expires.