Grade a TLS endpoint the way SSL Labs does: 30% protocol, 30% key exchange, 40% cipher strength, then apply the grade caps.
This mirrors the SSL Labs rating: three weighted components produce a numeric score, the score maps to a letter, and then a set of caps applies because some configurations are unsafe regardless of the average. The weakest accepted cipher is what counts, not the best, since an attacker chooses the negotiation. TLS grades are the one security metric your customers check themselves, and the caps mean a single legacy cipher suite or an expired certificate erases an otherwise perfect configuration.
TLS Configuration Score
numeric score = 0.3 × protocol score + 0.3 × key exchange score + 0.4 × cipher strength score, where the protocol score is the mean of the best and worst protocols accepted.
Grade and caps
Letter grade: ≥80 A, ≥65 B, ≥50 C, ≥35 D, ≥20 E, else F; A becomes A+ with HSTS and A- without forward secrecy; trust failures, expiry, SSL 2.0, NULL ciphers and insecure renegotiation override the score.
numeric score = 0.3 × protocol score + 0.3 × key exchange score + 0.4 × cipher strength score, where the protocol score is the mean of the best and worst protocols accepted. This mirrors the SSL Labs rating: three weighted components produce a numeric score, the score maps to a letter, and then a set of caps applies because some configurations are unsafe regardless of the average. The weakest accepted cipher is what counts, not the best, since an attacker chooses the negotiation.
TLS grades are the one security metric your customers check themselves, and the caps mean a single legacy cipher suite or an expired certificate erases an otherwise perfect configuration.
This calculator takes 10 inputs: Highest protocol supported, Lowest protocol accepted, Key exchange strength, Weakest cipher accepted, Forward secrecy on every negotiated suite, Certificate trusted and matching the hostname, Days until certificate expiry, HSTS with max-age of at least 31536000, OCSP stapling enabled, Insecure renegotiation or TLS compression enabled. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Because a downgrade attack negotiates the worst option available. Supporting TLS 1.3 is irrelevant if the server still answers a TLS 1.0 handshake, so the score averages best and worst and the caps handle the genuinely broken versions outright.