Get an A+ on SSL Labs — Hardening Your TLS Config

You installed SSL but SSL Labs only gives you a B or C? A good score doesn't come from simply having a certificate — it comes from a correct TLS configuration. This guide walks you through each step until your site earns an A+ on SSL Labs.

What is an SSL Labs A+ grade

SSL Labs (Qualys) is a free tool that scans your server's SSL/TLS configuration and grades it from F to A+. A+ is the highest score, requiring you to pass checks on protocols, ciphers, and key exchange, and to enable HSTS correctly. An A+ signals that your site encrypts connections securely to the latest standards.

What SSL Labs scores you on

A common misconception is that simply installing a valid certificate is enough. In reality SSL Labs evaluates four core categories and then uses the weakest one to cap your grade. That means a single weak area drags the whole score down, no matter how strong the others are. Understanding where the weighting falls lets you fix the right things rather than guessing.

The categories the engine grades are:

• Certificate: the certificate must be unexpired, match the domain, be trusted, and ship a complete chain — a serious certificate error drops you straight to a T (untrusted) grade.
• Protocol Support: the TLS versions you enable. The more legacy protocols like TLS 1.0/1.1 you leave on, the more points you lose, while TLS 1.3 earns full marks.
• Key Exchange: the size and strength of your keys, such as RSA 2048-bit or larger, or ECDSA, plus support for Forward Secrecy (ECDHE).
• Cipher Strength: the strength of the ciphers encrypting your data. AES-GCM 128/256-bit ciphers score high, while weak ciphers like RC4 or 3DES get penalized or knock you down a grade.

Once all four categories reach A level, earning the "A+" is a separate bonus that requires enabling HSTS. This is the dividing line between A and A+ that many sites overlook.

Checklist for an A+

Before you run a real scan, work through this checklist item by item. If every box is ticked, your odds of an A+ are very high. The table below summarizes what to do and why:

Step 1 — Disable old protocols

Enable only TLS 1.2 and TLS 1.3, and disable SSLv3, TLS 1.0 and TLS 1.1. On Apache (mod_ssl):

On Nginx:

Step 2 — Choose strong cipher suites

Use Forward Secrecy ciphers (ECDHE) and disable weak ones like RC4 and 3DES. On Nginx:

Step 3 — Enable HSTS (the key to A+)

Add this header to force browsers to always use HTTPS — this is what separates an A from an A+:

Once ready you can register on the HSTS Preload List at hstspreload.org.

Step 4 — OCSP Stapling and DH params

Enable OCSP Stapling to speed up certificate status checks, and use a Diffie-Hellman key of 2048 bits or more. On Nginx:

Example config to enable TLS 1.3 + HSTS (Nginx / Apache)

To see how every step comes together, here is a complete configuration that enables TLS 1.2/1.3 with strong ciphers, HSTS, and OCSP stapling in one place — ready to adapt to your server.

Nginx (inside the server { ... } block listening on 443):

Apache (inside <VirtualHost *:443> or your ssl.conf):

After editing the config, always test the syntax before reloading so you don't take the server down: Nginx uses nginx -t then systemctl reload nginx, while Apache uses apachectl configtest then systemctl reload apache2 (or httpd on some distributions).

Things to check before enabling HSTS preload

HSTS preload is a double-edged sword. It forces browsers to always use HTTPS for your domain — baked right into the browser — without waiting for the first header, which is very secure but hard to reverse. Before submitting to hstspreload.org, verify all of the following:

1. Every subdomain (including ones you haven't used yet) must support HTTPS, because includeSubDomains covers all of them — if any subdomain is still HTTP-only, users won't be able to reach it at all.
2. Certificates for the apex domain and every subdomain must renew automatically; otherwise once a certificate expires there is no way for users to bypass the warning.
3. Start with a short max-age (a few hours), then raise it to one year once you're confident, and only then add preload as the final step.
4. Removal from the preload list can take many months to propagate across all browsers, so don't rush to preload until you're 100% ready.

In short, a plain HSTS header is already enough for an A+. Submitting to the preload list is an extra step reserved for sites certain they will use HTTPS forever.

Verify with SSL Labs

After configuring, go to ssllabs.com/ssltest, enter your domain and wait for the result. If you're not at A+ yet, the report tells you exactly what's holding you back — old protocols still enabled, or missing HSTS. Fix what it flags and rescan.

One small gotcha trips up a lot of people: SSL Labs caches your most recent scan. If you've just changed the config and rescan immediately, you may still see the old result. Tick the "Clear cache" option or append &clearCache=on to the URL to force a fresh scan. Also remember to reload or restart the web service after every config change, otherwise the new values aren't actually live on the server yet.

Another point that's often overlooked: if your site sits behind a CDN or reverse proxy (such as Cloudflare), the TLS configuration end users see belongs to the edge, not your origin server. So if you use a CDN, you must tune TLS/HSTS on the CDN side too — otherwise no matter how perfectly you configure the origin, the grade SSL Labs reports is still the edge's.

Keeping your A+ over time

Earning an A+ the first time is only the start, because security standards keep shifting. A cipher considered strong today may be downgraded a few years from now, and new protocols keep arriving. Maintaining the grade means rechecking periodically — set a reminder to scan SSL Labs every 3-6 months, or any time you upgrade the server.

The things that most often drop the grade are few: a certificate nearing expiry that you forget to renew, a web server update that resets your cipher settings back to defaults, and adding a new subdomain without SSL while HSTS includeSubDomains is already on. Setting up automatic certificate renewal and documenting your tuned config keeps your site at A+ sustainably, without scrambling to fix it from scratch each time.

Frequently asked questions