Are your certificates healthy?
Enter a domain for an instant TLS health score and SSL grade — no signup, no server access
Leaderboard
Global TLS health ranking, filter by grade / industry / region
Badges
One line of code to show a live SSL grade badge on your site, README or docs.
DV, OV, EV and wildcard — instant issuance, 256-bit encryption, and a 30-day money-back guarantee.
Grading, explained
For SSL/TLS servers, the most widely adopted and authoritative grading standard comes from SSL Labs' SSL Server Test. It evaluates the server-side TLS configuration rather than the certificate file itself.
The scoring system combines multiple dimensions and produces a letter grade from A+ down to F. CertH maps its probe results onto the same grade semantics.
Grades & meanings
A near-perfect setup: TLS 1.3, strong ciphers, full forward secrecy (PFS) and correctly enabled HSTS. First choice for finance, payments and other high-stakes businesses.
Solid security with only minor issues — e.g. no HSTS preload or not fully leveraging TLS 1.3. The mainstream recommended grade.
Acceptable security but with notable issues. Under current standards, missing TLS 1.3 caps the best possible grade at A-.
Improvable issues: still supports TLS 1.1, no HSTS, or no PFS.
Clear security flaws: TLS 1.0 support, or weak ciphers such as RC4 / 3DES.
Serious or fatal weaknesses: SSLv3 support, deprecated SHA-1 signatures or 1024-bit RSA keys.
Critical failure: exploitable vulnerabilities, or certificate/hostname mismatch.
The certificate chain cannot be trusted, or the grade applies to a STARTTLS service.
The certificate's common name does not match the tested hostname.
Five scoring dimensions
The score weights these five areas:
Which TLS versions are enabled or disabled. Legacy protocols (SSLv2/v3, TLS 1.0/1.1) lose points — enable only TLS 1.2 and 1.3.
Strength of cipher suites. Disable null encryption, RC4 and 3DES; prefer AES-GCM and ChaCha20.
Security of the key exchange. Lack of forward secrecy (PFS) significantly hurts the grade — prefer ECDHE suites.
Validity checks on the certificate itself. Any failure (expired, hostname mismatch, etc.) can zero the score. Ensure sufficient key length (RSA >= 2048-bit, ECC >= 256-bit) and secure signing algorithms such as SHA-256.
Bonus mechanisms. Enabling HSTS and OCSP Stapling is key to reaching an A+ grade.
Good to know
- It grades configuration, not just certificatesThe score reflects the overall TLS posture — a valid certificate with misconfigured servers still scores low.
- Standards evolveSSL Labs updates its rules regularly to counter new threats — e.g. recent weight increases for TLS 1.3 and HSTS.
- Tools may differ slightlyImplementations vary subtly even when following the SSL Labs standard (e.g. how Qualys CertView handles forward secrecy).