SSL/TLS is the protocol that encrypts traffic between a browser and a website. "SSL" is the historic name; every secure connection today uses TLS (Transport Layer Security). A green padlock only means a connection is encrypted — it says nothing about whether the configuration behind it is strong or weak.
What a deep grade actually measures
A meaningful TLS grade looks past the padlock at several independent layers:
- Protocol versions. TLS 1.2 and 1.3 are current. TLS 1.0 and 1.1 are deprecated and should be disabled — leaving them on is the most common reason a site loses marks.
- Cipher suite & forward secrecy. Modern ciphers (ECDHE/AES-GCM) provide forward secrecy, meaning a future key compromise cannot decrypt past traffic.
- Certificate validity. Not expired, not yet-valid, and the hostname must match the certificate (including wildcards).
- Key & signature strength. RSA keys should be at least 2048-bit (or EC 256-bit), signed with SHA-256 or better — never SHA-1 or MD5.
- Chain of trust. The server should present a complete chain to a trusted root, not a self-signed or incomplete one.
- HSTS. The Strict-Transport-Security header forces browsers to use HTTPS, defeating downgrade attacks.
How to reach an A+
Enable only TLS 1.2 and 1.3, prefer ECDHE cipher suites, serve the full certificate chain, use a 2048-bit+ key with a SHA-256 signature, and add a long-lived HSTS policy with includeSubDomains and preload. Renew certificates well before expiry — many outages are simply a forgotten renewal.
Run the SSL/TLS Deep Grade on your domain to see exactly which of these you pass and which need attention.