Qualys SSL Labs or KrakenShield: getting an A+ and keeping it

Your web provider sends you a screenshot: a big green “A+”, courtesy of SSL Labs. Six months later, a customer reports a warning in their browser. In the meantime the certificate has been renewed, the hosting provider has migrated the server, and nobody has run the test again. The grade was accurate on the day it was taken. It said nothing about the day after.

This comparison is part of our monthly series in which we set KrakenShield against the market’s major tools. The rule of the series: compare like with like, say where the other tool is better, and who it suits.

Qualys SSL Labs in brief

SSL Labs is a non-commercial research effort run by Qualys, a US cloud security company that also sells products for large organisations, such as VMDR for vulnerability management. SSL Labs’ best-known service is the SSL Server Test: you enter a domain name, it analyses the server’s HTTPS configuration in depth and awards a grade from A+ to F.

Its strength lies in its published, regularly updated grading method, the “SSL Server Rating Guide”. The grade combines three weighted scores, protocol support (30%), key exchange (30%) and cipher strength (40%), then applies caps. Two special grades flag certificate problems: T when it is not trusted, M when it does not match the site’s name.

Version 2009r of the guide, published on 16 May 2025, tightened the rules: without a valid HSTSHSTSA security header through which a website tells the browser to connect to it over HTTPS only, which stops an attacker from downgrading the connection to unencrypted HTTP. header or without TLS 1.3, the grade drops to A-. Since 2020, still accepting TLS 1.0 or 1.1 has capped it at B.

Where SSL Labs wins, hands down

Let us be honest: for a one-off check, SSL Labs is hard to beat.

• Free, no account. One domain, one click, one report. No sign-up, no commitment. To check a site in two minutes, nothing beats it.
• The recognised benchmark. When an auditor, a customer or an insurer talks about an “A+”, they mean SSL Labs. Its published guide is the profession’s common language.
• Handshake simulation. The report simulates the TLS handshake of dozens of browsers, operating systems and libraries, old and new. You know whether an ageing Android device or a Java application will still connect after you remove a protocol. KrakenShield does not run this simulation.
• Protocol detail. Every cipher suite, every extension, every certificate in the chain is listed. For an administrator fine-tuning a configuration, it is a goldmine.
• APIs. Qualys offers free APIs, with restrictions, to automate regular testing.

What SSL Labs does not set out to do

The SSL Server Test answers one question: “Is this server’s TLS configured properly, today?” It is not designed to go further.

• The other headers. HSTS counts towards the grade, but the other security headers (Content-Security-Policy, X-Frame-Options, Referrer-Policy) are not part of the guide.
• The domain’s context. Email security (SPF, DMARC) and publicly visible subdomains are outside the test.
• Tracking. With no account, there is no personal history, no comparison between two analyses and no reminder if the grade drops.
• Fixes. The report tells you what is wrong. Working out which line to change in Apache or Nginx is up to you.

That makes sense: it is not its job. But that is exactly where an A+ gets lost.

What KrakenShield’s SSL/TLS audit does

KrakenShield’s SSL/TLS audit does not try to replace SSL Labs. It follows the same grading method and adds what you need to keep the grade over time.

• The same grading method. The analysis relies on the up-to-date, open-source testssl.shtestssl.shA free script that audits a server’s TLS configuration: accepted protocols, cipher suites, certificate and security headers. engine and calculates a grade from A+ to F using the SSL Labs method. The 2009r rules apply: no HSTS or no TLS 1.3 brings the grade down to A-, and an A+ requires HSTS for at least 180 days.
• Certificate and protocols. Validity, certificate chain, names covered, key size, expiry date, versions from SSL 2 to TLS 1.3, cipher suites, forward secrecy and known TLS vulnerabilities.
• Security headers. Redirect to HTTPS, HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and disclosed server version.
• The public footprint. DNS records, SPF and DMARC, publicly visible subdomains.
• Explained fixes. Each finding is ranked by severity, with its fix and sample Apache and Nginx configuration, in the console and as a PDF to pass on to your hosting provider.
• Non-intrusive. A few TLS connections and HTTP requests, just like a browser. Any public website can be audited, with no ownership check.

For cookies and trackers, a separate privacy audit observes what your home page drops before any choice, after refusal and after acceptance.

Keeping the A+: tracking over time

This is where the two approaches really part ways.

• History. Every audit stays in your console. You can compare two audits of the same domain to see what has been fixed and what has appeared.
• Reminders. If an audit grades below A-, an email is sent three days later asking you to fix the issues and run the audit again. If you already have, nothing is sent.
• Public report and badge. For a domain whose ownership you have proved, you can publish a link to a reduced version of the report (grade and key facts, with no IP address or raw findings) and a badge to display on your site. After 90 days the badge turns grey, “to be renewed”: an old grade no longer proves anything.
• AI assistants. A public MCP server offers the check_ssl tool: a quick check of the certificate and headers, without a grade, from a compatible assistant.

Head to head

Combining them: good practice

The two tools are not mutually exclusive. The most effective set-up:

• A full, tracked audit (TLS, headers, DNS and email) every month and after every change of server or hosting provider.
• A run on SSL Labs before removing a protocol or cipher suite, to check in the simulation that no important client will be cut off.
• Automatic certificate renewal, confirmed by an audit in the days that follow.
• A retest after every fix, with the SSL Labs cache cleared.
• Security headers handled separately once TLS is clean: they matter just as much to your visitors.

To roll out those headers step by step, read the surface audit page, which lists each header checked, and the Encryption without the maths chapter of “Cyber A to Z”.

Our take

• You run servers and want to understand a configuration in detail: SSL Labs is your tool, it is free, and its client simulation has no equivalent on our side.
• You run a small business or a web agency and want your A+ to stay an A+: a tracked audit, with reminders and explained fixes, saves you from rediscovering the problem through a customer.
• You need to prove your security level to a customer, an insurer or a prime contractor: combine both, SSL Labs as the recognised benchmark, and a dated, publishable report that is renewed regularly.

KrakenShield’s SSL/TLS audit grades your website from A+ to F in a few minutes and tells you what to fix first. To understand what a TLS grade really measures, from the certificate to HSTS, read the Encryption without the maths chapter of “Cyber A to Z”.

Qualys is a trademark of Qualys, Inc.; SSL Labs is a service of Qualys, Inc. All trademarks mentioned belong to their respective owners. Comparison based on the tools’ public documentation as of October 2026.