CertH Grade vs SSL Labs: How the Two Ratings Differ
Updated 2026-11-03 · 5 min read
Two tools, two letters, occasionally two different answers for the same domain. That is not a bug in either — the ratings answer slightly different questions at different depths.
What both measure
Both CertH and SSL Labs start from a live TLS handshake and end with a 0–100 score plus a letter grade. Both reward modern protocol versions, strong ciphers, valid certificates and HSTS. For a well-configured site, the two usually agree, and an A+ in one is an A+ in the other.
Both also treat an expired certificate as a hard failure rather than a small deduction, because a certificate that is not valid makes the rest of the configuration irrelevant.
Where they diverge
SSL Labs runs a much deeper analysis: it enumerates every cipher suite the server accepts, tests a wide matrix of simulated clients, and inspects protocol-specific quirks. That depth is why a full assessment takes minutes and why it occasionally surfaces issues a single handshake cannot see.
CertH performs one handshake per probe and scores what a real client would negotiate, plus the certificate chain and the presence of HSTS and OCSP stapling. It is deliberately shallow enough to run across twenty thousand domains every day, which is what makes a leaderboard and a 90-day history possible.
The practical difference: SSL Labs answers "how deep are the problems in this endpoint", CertH answers "how does this endpoint behave today, compared to everything else".
When they disagree
The most common disagreement is a site with an unusual cipher preference: a single handshake negotiates one suite, while SSL Labs enumerates all of them and may find a weak one that only old clients would pick. In that case SSL Labs is more accurate about the risk, and CertH is more accurate about what a modern browser experiences.
The second is timing. CertH scans daily, SSL Labs caches results. A configuration change can appear in CertH within a day while the other tool still shows the previous assessment.
How to use both
Use CertH for monitoring: it tells you when a grade drops, what changed, and how a site compares to its peers. Use SSL Labs when you are actively changing a configuration and want the exhaustive view before and after.
Every domain report on CertH links directly to the SSL Labs assessment for the same host, so you can move between the two without retyping the domain.
FAQ
Why is my CertH grade different from my SSL Labs grade?
The two use different scoring models. CertH scores a single negotiated handshake plus certificate and HSTS signals; SSL Labs enumerates the full cipher matrix with simulated clients. Minor differences are expected, especially on servers with unusual cipher preferences.
Which one should I trust?
For day-to-day monitoring and change detection, CertH. For a one-off deep audit before a migration, SSL Labs. If the two disagree strongly, the deeper scan is usually the one describing the risk.