Documentation

The lock grade: what earns each of the five locks

A TLS check grades the server's configuration with one to five locks. The grade is a summary you can read at a glance; the findings underneath it say what to change. This page sets out exactly what earns each grade, so that a grade you disagree with can be traced to the finding that gave it.

The five grades

How a grade is read

• It grades configuration, not time. A certificate that expires in five days keeps its locks. The expiry is what the check's status is for; mixing the two would make the grade fall with every renewal cycle and mean nothing.
• Several baselines: the lowest. Four locks means every baseline you chose is met, so no baseline has to be marked as the main one. Each result also carries the grade against every supported baseline, selected or not, so you can see what adding one would do.
• Severity does not change it. Whether a finding warns, fails or is only recorded is your choice on the check; the grade describes the server. Two checks of the same server with the same baselines show the same grade.
• Incomplete data caps it. When the daily test could not establish everything a selected baseline's rules read, that baseline counts as not met and the grade stops at three locks; anything else it could not establish withholds the fifth. Four locks say every selected baseline is met, which a rule that could not be applied cannot support. The result lists posture_incomplete among what holds the grade back.
• What holds it back is listed. Below five locks, the result names the findings that kept the grade from the next one, and the result drawer marks them.
• Some things never cost a lock. Encrypted Client Hello and HSTS preloading depend on a CDN or a browser vendor's list as much as on you. OCSP stapling costs a lock only where a selected baseline requires it and the certificate's CA runs OCSP at all. The obsolete pinning headers are only noted.
• What does not apply costs nothing. A server with a single TLS version has nothing to downgrade to, so the downgrade signal is not asked of it. A closed port 80 has nothing to redirect, and the HTTP conditions apply only with the HTTP checks on, which they are by default on port 443.
• Per location. Each location grades what it saw. The check's page shows the lowest grade across its locations and each location's own.

When there is no grade

A grade needs a configuration probe, which runs at most once a day for each server and location. Until the first one, while a probe is postponed because the server's daily allowance is used, and for a server whose operator asked us not to probe it, a result carries no grade. Expiry, trust and the other availability checks run on every check regardless.

Versions

These are the rules of grading version 3. Each result records the version that graded it, so a later version that tightens a rule never shows up as a drop in a server's history; it applies from its date on. A new edition of a baseline is not a new grading version: the result records the edition separately.