Why It Matters

Scoring an A+ on SSL Labs validates that your server SSL configuration adheres to modern cybersecurity best practices, shielding your infrastructure against SSL vulnerabilities like BEAST, POODLE, and Heartbleed.

  • Disable Outdated Protocols: Disable SSLv2, SSLv3, TLS 1.0, and TLS 1.1, enabling strictly TLS 1.2 and TLS 1.3 protocols.

  • Enable HSTS: Deploy a Strict-Transport-Security header with a long duration (max-age=31536000; includeSubDomains). SSL Labs requires HSTS with a max-age of at least six months for an A+. Adding preload and submitting your domain to hstspreload.org is optional and hard to undo, so only do it once every subdomain works over HTTPS.

  • Secure Cipher Suites: Configure cipher suites prioritizing ECDHE ciphers to provide Elliptic Curve Forward Secrecy.

  • Complete Certificate Trust Chain: Install all required intermediate CA certificates to eliminate trust chain gaps.

  • TLS Fallback Protection: If an older protocol must stay enabled, support TLS_FALLBACK_SCSV to prevent downgrade attacks. Once only TLS 1.2 and 1.3 are enabled, this is no longer a concern.