The difference between an A and an A+ on SSL Labs is one HTTP response header.
Not a better certificate. Not a stronger key. Not a rearchitected handshake. You add Strict-Transport-Security with a max-age of at least six months — 15768000 seconds, one line — and your grade goes from very good to perfect. I have watched people celebrate that jump like they shipped a security feature. They shipped a header.
I don’t say this to sneer at SSL Labs. It’s a genuinely good tool, and it’s been the reference for TLS configuration since Ivan Ristić built it in 2009. When I need to know whether a server negotiates modern protocols, keeps a clean certificate chain, and hasn’t left RC4 or an incomplete chain lying around, SSL Labs is where I look. The grade is honest about the thing it grades. The problem is what people believe the grade means, and the belief is wildly larger than the measurement.
What the grade actually scores
SSL Labs computes three numbers and averages them with fixed weights: protocol support at 30%, key exchange at 30%, cipher strength at 40%. There’s also a certificate check that acts as a gate — a bad cert can fail you outright. Score 80 or higher and you get an A. Below that it slides to B, C, D, and down.
Then come the caps, and the caps are the interesting part. Support TLS 1.0 or 1.1 and your grade is capped at B no matter how good everything else is. No forward secrecy: capped at B. RC4 anywhere: B. Weak Diffie-Hellman parameters under 2048 bits: B. An incomplete certificate chain: B. No TLS 1.3: capped at A-. The scoring is really a checklist of known-bad configurations wearing a numeric costume. Avoid every item on the naughty list and you land at A. That’s the whole game.
Which is fine — avoiding known-bad TLS config is worth doing, and most of the internet still doesn’t. But look at what’s being measured. Every single input is a property of the channel: the protocol version, the cipher, the key exchange, the chain. Not one of them is a property of the thing on the other end of the channel.
The rating guide says this itself, in plain text most people never read: SSL “does not and cannot address a number of possible security issues.” It’s talking about the application. Session handling, authentication logic, injection, the actual software serving the bytes — none of it is in scope, because none of it is visible from a TLS handshake. SSL Labs measures the pipe. It says nothing about what flows through it.
A phishing kit gets an A+
Here’s the demonstration that should end the argument. A phishing site — one built to steal your bank login, hosted this morning on a throwaway domain — routinely scores an A or A+ on SSL Labs.
Of course it does. It gets a free certificate from Let’s Encrypt in about twenty seconds. It sits behind Cloudflare or a modern host that negotiates TLS 1.3 with AEAD ciphers and forward secrecy by default. It adds the HSTS header because the tutorial said to. Every input SSL Labs looks at comes back clean, because the criminal is using the same 2026-default infrastructure your bank uses. The channel to the phishing page is impeccably secured. It’s the destination that’s a felony.
This isn’t a knock on SSL Labs. It’s the point. The grade certifies transport, and transport to a fraud site is still good transport. But the padlock-adjacent instinct — A+ means safe — is exactly the misread the grade invites, and the industry leans into it. “SSL Labs A+” shows up in vendor security pages, in RFP responses, in compliance evidence, as if it were a statement about the organization rather than a statement about its TLS parameters.
The A-to-A+ tell
Go back to that one header. The reason the A-to-A+ gap bothers me so much is that it’s the grade admitting its own ceiling.
By the time you have an A, you’ve done the substantive work: modern protocols, strong ciphers, forward secrecy, a valid chain. Everything TLS configuration can meaningfully express, you’ve expressed. So what does the top grade, the one everyone actually wants, add on top? HSTS with a long max-age and the absence of any warnings. A directive telling browsers to refuse plaintext next time. It’s a good header. I recommend it. But it is not a new tier of security — it’s the same channel with a sticky note asking browsers to remember it’s HTTPS.
When the distance between “very good” and “the best possible” is a single response header, the scale has run out of things to measure. That’s not a flaw you fix by adding more grades. It’s the honest edge of what an external TLS scan can see. The A+ is the highest score a peephole can give you.
So what is it good for
The grade earns its keep as a regression alarm and a floor.
As a floor, “get every server to at least an A” is a fine engineering directive. It rules out a specific, well-understood set of TLS mistakes, and a fleet that all scores A has genuinely fewer channel-level footguns than one that doesn’t. As a regression alarm, it’s even better: if a server was A+ last quarter and it’s a B today, something changed — a protocol got re-enabled, a chain broke in a deploy, a cipher config drifted. That delta is a real signal worth alerting on.
What it is not is a security posture. It’s not evidence your application is safe, your authentication is sound, or your data is protected from anything except passive eavesdropping on the wire. Those are the failures that actually get people breached, and they are all invisible to a handshake.
I’d make one change if I could, and it’s not to the scoring. It’s to the culture around it. Stop treating A+ as an achievement and start treating A as the baseline it is — the price of admission, not a trophy. The organizations I trust least are often the ones proudest of their A+, because it’s the security work that’s cheap to do and easy to show. The expensive, invisible work — the work no external scanner will ever grade — is the work that decides whether the A+ meant anything at all.
The padlock told users a lie for years: that encrypted meant trustworthy. The A+ tells professionals a smaller, more sophisticated version of the same lie. Configured-well is not the same as safe. It never was. It’s just easier to measure.