Forward secrecy means each session gets an ephemeral key that is discarded afterward. Steal the server’s long-term private key next year and the traffic somebody recorded this year is still unreadable, because the keys that protected it were never stored.
Without it, one key compromise retroactively unlocks everything anyone captured. This is why it carries weight in the Confidentiality and Agility category.
SSLBoard classifies each host using the TLS versions it observed plus evidence of a forward-secret cipher for pre-TLS-1.3 connections.
The five classifications
| Classification | What was observed |
|---|---|
| TLS 1.3 and legacy PFS | TLS 1.3 support plus a forward-secret cipher for older TLS. The result you want |
| Legacy PFS only | Forward-secret ciphers on older TLS, no TLS 1.3 observed. Safe, but behind |
| TLS 1.3 only, with older versions | TLS 1.3 exists, older versions are also offered without observed legacy PFS. Older clients are the exposure here |
| Strict TLS 1.3 only | TLS 1.3 is the only version observed. Deliberately kept separate from the row above |
| No PFS | Older TLS observed with no forward-secret cipher reported |
The third row is the trap, and it is common. Enabling TLS 1.3 feels like the job is done, but every client that cannot speak it falls back to a path with no forward secrecy. The fix is either forward-secret ciphers on the older path or removing the older path.
Three ways to misread a classification
- Unknown is not No PFS. If neither version data nor legacy PFS evidence came back, no classification can be made. That is an absence of evidence, not a confirmed absence of forward secrecy.
- A healthy host label does not certify every address. Host classifications combine that host’s endpoint results, which is good for inventory and not good enough for a change. Where consistency matters, open the endpoint evidence.
- An RSA certificate does not imply missing forward secrecy. Authentication and key exchange are different parts of the handshake, and this is the single most common mix-up on this check. See key analysis.
What to change
Work out whether the affected TLS terminator supports ephemeral key exchange for the older clients you genuinely still need, or whether those older protocol paths can simply go. Check the real server configuration rather than assuming TLS 1.3 covers everyone.
Rescan afterward and read the classification together with the protocol and cipher details. Confirm your intended clients still connect.