TLS/SSL Config Snippet Grader

Paste a TLS/SSL configuration block from your Nginx or Apache server and get an instant A-to-F security grade, a finding-by-finding breakdown of what's right and wrong, and a ready-to-use replacement snippet that follows current best practices.

What it checks

The grader parses ssl_protocols/ssl_ciphers (Nginx) or SSLProtocol/SSLCipherSuite (Apache) directives and flags:

• Deprecated protocols — SSLv2, SSLv3, TLS 1.0, and TLS 1.1 are all considered broken or obsolete by modern standards (PCI DSS, browser vendors, and RFC 8996 all require disabling them).
• Weak or broken ciphers — RC4, DES, 3DES, MD5-based ciphers, export-grade ciphers, and anonymous (no-auth) ciphers are called out individually.
• Forward secrecy — the config is checked for at least one ECDHE or DHE cipher suite, without which a compromised private key can decrypt all previously captured traffic.
• HSTS — a Strict-Transport-Security header with a strong max-age protects against SSL-stripping downgrade attacks.
• OCSP stapling — enabling it speeds up and privatizes the TLS handshake.
• Cipher-order preference and reliance on brittle OpenSSL aliases (HIGH, MEDIUM) instead of an explicit cipher list.

Each finding is scored (critical findings cost the most points) and rolled up into a 0–100 score and letter grade.

How to use it

1. Paste your ssl_protocols/SSLProtocol and ssl_ciphers/SSLCipherSuite lines (a full server block also works — the grader only reads the relevant directives).
2. Choose the server type, or leave it on Auto-detect.
3. Pick a target hardening profile (Modern, Intermediate, or Old) to match the compatibility your traffic actually needs.
4. Review the grade, the findings list, and copy the suggested replacement snippet.

Everything runs client-side — your configuration is never sent to a server.

Why does the "suggested" snippet differ from my ciphers even when my grade is good?

The suggestion always shows the current Mozilla SSL Configuration Generator baseline for your chosen profile, regardless of your score, so you have a single reference to diff against — a passing grade just means your config already meets the bar the generator is applying.

Does this check my certificate itself?

No — this tool only grades the protocol/cipher/HSTS/stapling configuration. For certificate chain, expiry, or key-strength issues, use a certificate-focused checker instead.