TLS & certificate guides

The exact TLS settings CertH and SSL Labs look for when awarding an A+, with copy-paste nginx and Apache configuration and the mistakes that keep sites at A.

What TLS 1.3 actually removes, why it is required for an A+ SSL grade, how to enable it on nginx, Apache and Cloudflare, and how to verify the handshake from a terminal.

How Strict-Transport-Security works, what max-age really controls, when includeSubDomains and preload are dangerous, and a staged rollout that does not take your site down.

What OCSP stapling does, why it protects visitor privacy, how to enable it on nginx and Apache, how to verify it is actually working, and why it is not required for an A+.

A green padlock only means the certificate is valid for that hostname. Here are the six TLS configuration failures that produce an F anyway, and how to diagnose each one.

Both produce a letter grade from 0 to 100, and they often disagree. Here is how CertH scoring differs from SSL Labs, when to trust which, and why a daily programmatic scan exists at all.