The TLS score summarizes selected observations in seven weighted categories. It is a prioritization aid, not a percentage probability of being secure.
Categories and weights
| Category | Weight | Observations that affect it |
|---|---|---|
| Certificate Health | 30% | Served certificates that are expired, revoked, or near expiry; revoked OCSP responses. |
| Protocols | 15% | SSLv3, TLS 1.0, TLS 1.1, and certain OCSP stapling failures. |
| Ciphers | 15% | Flagged cipher families on assessed hosts. |
| Confidentiality and Agility | 20% | Forward secrecy gaps, RSA-only hosts, and DNSSEC zone enumeration findings. |
| Web Hardening | 10% | HTTP redirect gaps, missing HSTS, and browser security-header findings. |
| Reliability | 5% | Selected connection failures, missing or broken DNSSEC, and signature-expiry risk. |
| Future Readiness | 5% | Coverage of TLS 1.3, elliptic-curve certificates, and post-quantum key exchange. |
The current report labels are Good at 80 or above, Fair at 60–79, Poor at 40–59, and Critical below 40. These are SSLBoard’s own bands.
Why one finding can cost different amounts
Most categories begin at 100. Each applicable issue reduces the remaining category score using a rule-specific multiplier. The reduction depends on both the number affected and the share of eligible observations affected. The final score is the weighted sum of the category scores.
For most issue rules, the exposure amount is log2(affected + 1) + 3 × affected / eligible. The rule’s multiplier is raised to that amount and applied to the category’s remaining score. Reliability rules normalize the logarithmic part by log2(eligible + 1) when an eligible count exists. This prevents the score from being a simple count of findings.
Future Readiness instead combines coverage: TLS 1.3 contributes half of that category, elliptic-curve certificates one quarter, and post-quantum readiness one quarter. Components without eligible observations are omitted and the remaining weights are normalized.
What the score leaves out
Not everything displayed in a report changes the score. Email-security results, CAA policy rows, and adjacent-domain relationships do not feed the current TLS score. Key-strength details provide evidence beyond the RSA-versus-ECC coverage used in scoring.
Missing observations do not automatically become failures in every category. A category without applicable penalties can remain at 100, and Future Readiness defaults to 100 when it has no eligible components. Always inspect scan coverage and errors before relying on a high score.
Comparing two reports
Compare the findings and affected endpoints as well as the number. New discovery data, changed DNS answers, different eligible counts, and scoring changes can move the score even if you changed only one server. A successful remediation is first demonstrated by the affected endpoint no longer showing the problem in a fresh report.
The breakdown’s issue penalties are within their category; the category weight determines their contribution to the overall score. Headline finding severity can differ from the scoring rule’s severity because the headline may group several observations.