TLS Configuration Score Calculator

Grade a TLS endpoint the way SSL Labs does: 30% protocol, 30% key exchange, 40% cipher strength, then apply the grade caps.

About TLS Configuration Score Calculator

This mirrors the SSL Labs rating: three weighted components produce a numeric score, the score maps to a letter, and then a set of caps applies because some configurations are unsafe regardless of the average. The weakest accepted cipher is what counts, not the best, since an attacker chooses the negotiation. TLS grades are the one security metric your customers check themselves, and the caps mean a single legacy cipher suite or an expired certificate erases an otherwise perfect configuration.

Formulas

TLS Configuration Score

numeric score = 0.3 × protocol score + 0.3 × key exchange score + 0.4 × cipher strength score, where the protocol score is the mean of the best and worst protocols accepted.

protocol score: Mean of best and worst protocol, 100 for TLS 1.3 down to 0 for SSL 2.0
cipher strength: Scored on the weakest suite the server will negotiate

Grade and caps

Letter grade: ≥80 A, ≥65 B, ≥50 C, ≥35 D, ≥20 E, else F; A becomes A+ with HSTS and A- without forward secrecy; trust failures, expiry, SSL 2.0, NULL ciphers and insecure renegotiation override the score.

A+: Top grade, requires HSTS with a one-year max-age
T: Trust failure, reported instead of a grade

Worked example

With the default values below, TLS Configuration Score Calculator returns TLS Grade of A+. Change any input above and every figure here is recalculated in your browser.

Inputs used

Highest protocol supportedone of TLS 1.3 — 100, TLS 1.2 — 95, TLS 1.1 — 90: TLS 1.3 — 100
Lowest protocol acceptedone of TLS 1.3 — 100, TLS 1.2 — 95, TLS 1.1 or 1.0 — 90, SSL 3.0 — 80, SSL 2.0 — 0: TLS 1.2 — 95
Key exchange strengthone of ECDHE P-384 or 4096-bit DH — 100, ECDHE P-256 or 2048-bit DH — 90, 1024-bit DH — 80, 512-bit or export grade — 40, Anonymous or weak key — 0: ECDHE P-256 or 2048-bit DH — 90
Weakest cipher acceptedone of AES-256 or ChaCha20 — 100, AES-128 — 90, 3DES or RC4, under 128-bit effective — 80, Export or NULL cipher — 0: AES-128 — 90
Forward secrecy on every negotiated suite: Yes
Certificate trusted and matching the hostname: Yes
Days until certificate expiryaccepts -365–3,650 days: 60 days
HSTS with max-age of at least 31536000: Yes
OCSP stapling enabled: Yes
Insecure renegotiation or TLS compression enabled: No

Results

TLS Grade: A+
Numeric Score: 92.3 / 100
Protocol Score: 97.5 / 100
Grade Cap Applied: No cap applied
Certificate Assessment: Valid with comfortable headroom
Highest-Value Fix: Configuration is at the top grade — keep the cipher list under review

Step by step

1Values used
2TLS Configuration Score
3Grade and caps
4TLS Grade= A+
5Numeric Score= 92.3 / 100
6Protocol Score= 97.5 / 100
7Grade Cap Applied= No cap applied
8Certificate Assessment= Valid with comfortable headroom
9Highest-Value Fix= Configuration is at the top grade — keep the cipher list under review

Assumptions and limits

The result is derived only from the 10 inputs listed above. Anything not among them is not part of the calculation.
In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is TLS Configuration Score calculated?

numeric score = 0.3 × protocol score + 0.3 × key exchange score + 0.4 × cipher strength score, where the protocol score is the mean of the best and worst protocols accepted. This mirrors the SSL Labs rating: three weighted components produce a numeric score, the score maps to a letter, and then a set of caps applies because some configurations are unsafe regardless of the average. The weakest accepted cipher is what counts, not the best, since an attacker chooses the negotiation.

Why does TLS Configuration Score matter?

TLS grades are the one security metric your customers check themselves, and the caps mean a single legacy cipher suite or an expired certificate erases an otherwise perfect configuration.

What values do I need to enter?

This calculator takes 10 inputs: Highest protocol supported, Lowest protocol accepted, Key exchange strength, Weakest cipher accepted, Forward secrecy on every negotiated suite, Certificate trusted and matching the hostname, Days until certificate expiry, HSTS with max-age of at least 31536000, OCSP stapling enabled, Insecure renegotiation or TLS compression enabled. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why is the worst protocol scored, not just the best?

Because a downgrade attack negotiates the worst option available. Supporting TLS 1.3 is irrelevant if the server still answers a TLS 1.0 handshake, so the score averages best and worst and the caps handle the genuinely broken versions outright.