How to Get an A+ SSL Grade (2026 Checklist)

What actually decides the grade

CertH scores five weighted areas from a pure TLS handshake: certificate validity and chain, key strength and signature algorithm, protocol versions offered, cipher suites negotiated, and HSTS plus OCSP stapling. There is no server access, no agent, and no configuration file upload — everything is observed from the outside, exactly as a browser would see it.

The thresholds are simple. A+ needs a score of 95 or higher, TLS 1.3 in the negotiated protocol list, and HSTS that is either preloaded or has a max-age of at least 180 days. A starts at 90, B at 80, C at 70, D at 55, and anything below 55 is an F. An expired certificate is an automatic 0.

The four changes that move you from A to A+

In practice the gap is almost always one of these four. Fix them in order — each one is independently verifiable from the outside, so you can re-scan after every step.

• •Enable TLS 1.3. It is worth points on its own and it is required for A+ even at a perfect 100 elsewhere.
• •Raise HSTS to at least max-age=15552000 (180 days). One year (31536000) is the common choice.
• •Serve a complete chain, including intermediates. A missing intermediate shows up as a chain error in some clients and costs points.
• •Enable OCSP stapling so the revocation check travels with the handshake instead of leaking the visitor IP to the CA.

nginx configuration that scores A+

This is a complete server block fragment for a modern nginx (1.19+ with OpenSSL 1.1.1+). If your nginx was built against an older OpenSSL, TLS 1.3 will be silently unavailable no matter what you write here — check with nginx -V first.

ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;

ssl_session_cache shared:SSL:10m;
ssl_session_timeout 1d;
ssl_session_tickets off;

ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;
resolver 1.1.1.1 8.8.8.8 valid=300s;

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

Apache configuration that scores A+

Apache needs the stapling cache declared once at server level, not inside a virtual host. Everything else goes inside the <VirtualHost *:443> block.

SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384
SSLHonorCipherOrder off
SSLSessionTickets off

SSLUseStapling on
SSLStaplingCache "shmcb:logs/ssl_stapling(32768)"

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

The mistakes that keep sites at A

The most common one is enabling HSTS with includeSubDomains on a domain that still has plain-HTTP subdomains — that breaks them instantly, and the usual reaction is to remove the header entirely, which drops you back to A. Roll out HSTS in stages: start with a 300-second max-age, watch for breakage for a week, then ramp to a year.

The second most common mistake is assuming TLS 1.3 is on because the certificate is modern. Certificates and protocol versions are independent. A brand-new certificate on a server that only speaks TLS 1.2 still scores below 95.

The third is a CDN in front of the origin. If Cloudflare, Fastly or a load balancer terminates TLS, the origin configuration is irrelevant — the grade reflects the edge, so the setting has to be changed there.

Verify it yourself

You can confirm each change from a terminal in a few seconds. TLS 1.3 negotiates only if the server actually offers it, HSTS shows up in response headers, and stapling appears in the OCSP response block.

# Does the server actually negotiate TLS 1.3?
openssl s_client -connect example.com:443 -tls1_3 -servername example.com </dev/null 2>/dev/null | grep "Protocol"

# Is HSTS set, and for how long?
curl -sI https://example.com | grep -i strict-transport-security

# Is OCSP stapling actually working?
openssl s_client -connect example.com:443 -status -servername example.com </dev/null 2>/dev/null | grep -A2 "OCSP Response"

FAQ