TLS Configuration Score Calculator
Grade a TLS endpoint the way SSL Labs does: 30% protocol, 30% key exchange, 40% cipher strength, then apply the grade caps.
Inputs
TLS Grade
A+
Numeric Score
92.3/ 100
Protocol Score
97.5/ 100
Grade Cap Applied
No cap applied
Certificate Assessment
Valid with comfortable headroom
Highest-Value Fix
Configuration is at the top grade — keep the cipher list under review
Step by step
Values used
Highest protocol supported = TLS 1.3 — 100; Lowest protocol accepted = TLS 1.2 — 95; Key exchange strength = ECDHE P-256 or 2048-bit DH — 90; Weakest cipher accepted = AES-128 — 90; Forward secrecy on every negotiated suite = Yes; Certificate trusted and matching the hostname = Yes; Days until certificate expiry = 60 days; HSTS with max-age of at least 31536000 = Yes; OCSP stapling enabled = Yes; Insecure renegotiation or TLS compression enabled = No
TLS Configuration Score
numeric score = 0.3 × protocol score + 0.3 × key exchange score + 0.4 × cipher strength score, where the protocol score is the mean of the best and worst protocols accepted.
Grade and caps
Letter grade: ≥80 A, ≥65 B, ≥50 C, ≥35 D, ≥20 E, else F; A becomes A+ with HSTS and A- without forward secrecy; trust failures, expiry, SSL 2.0, NULL ciphers and insecure renegotiation override the score.
TLS Grade
= A+
Numeric Score
= 92.3 / 100
Protocol Score
= 97.5 / 100
Grade Cap Applied
= No cap applied
Certificate Assessment
= Valid with comfortable headroom
Highest-Value Fix
= Configuration is at the top grade — keep the cipher list under review
How it works
This mirrors the SSL Labs rating: three weighted components produce a numeric score, the score maps to a letter, and then a set of caps applies because some configurations are unsafe regardless of the average. The weakest accepted cipher is what counts, not the best, since an attacker chooses the negotiation. TLS grades are the one security metric your customers check themselves, and the caps mean a single legacy cipher suite or an expired certificate erases an otherwise perfect configuration.
Formulas
TLS Configuration Score
numeric score = 0.3 × protocol score + 0.3 × key exchange score + 0.4 × cipher strength score, where the protocol score is the mean of the best and worst protocols accepted.
- protocol score
- Mean of best and worst protocol, 100 for TLS 1.3 down to 0 for SSL 2.0
- cipher strength
- Scored on the weakest suite the server will negotiate
Grade and caps
Letter grade: ≥80 A, ≥65 B, ≥50 C, ≥35 D, ≥20 E, else F; A becomes A+ with HSTS and A- without forward secrecy; trust failures, expiry, SSL 2.0, NULL ciphers and insecure renegotiation override the score.
- A+
- Top grade, requires HSTS with a one-year max-age
- T
- Trust failure, reported instead of a grade
Frequently Asked Questions
How is TLS Configuration Score calculated?
numeric score = 0.3 × protocol score + 0.3 × key exchange score + 0.4 × cipher strength score, where the protocol score is the mean of the best and worst protocols accepted. This mirrors the SSL Labs rating: three weighted components produce a numeric score, the score maps to a letter, and then a set of caps applies because some configurations are unsafe regardless of the average. The weakest accepted cipher is what counts, not the best, since an attacker chooses the negotiation.
Why does TLS Configuration Score matter?
TLS grades are the one security metric your customers check themselves, and the caps mean a single legacy cipher suite or an expired certificate erases an otherwise perfect configuration.
What values do I need to enter?
This calculator takes 10 inputs: Highest protocol supported, Lowest protocol accepted, Key exchange strength, Weakest cipher accepted, Forward secrecy on every negotiated suite, Certificate trusted and matching the hostname, Days until certificate expiry, HSTS with max-age of at least 31536000, OCSP stapling enabled, Insecure renegotiation or TLS compression enabled. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Why is the worst protocol scored, not just the best?
Because a downgrade attack negotiates the worst option available. Supporting TLS 1.3 is irrelevant if the server still answers a TLS 1.0 handshake, so the score averages best and worst and the caps handle the genuinely broken versions outright.