TLS Letter Grade System
In addition to the system-level 0-100 score, each TLS port, application, and the overall system receives a letter grade (A+ through F) derived from what the scanner observes on the wire: TLS protocol, key exchange, certificate, and cipher suite quality.
Grade Thresholds
| Grade | Score | Meaning |
|---|---|---|
| A+ | 98-100 | CNSA 2.0 compliant - ML-KEM-1024 + post-quantum cert + TLS 1.3. |
| A | 85-97 | Quantum ready - PQC KEX present (ML-KEM-768 or hybrid), strong cert. |
| B | 70-84 | Best achievable with classical-only crypto - TLS 1.3 + X25519 + good cert. |
| C | 50-69 | Moderate risk - TLS 1.2 + ECDHE or weak cert. |
| D | 30-49 | Significant risk - RSA KEX, old TLS, or poor cert. |
| F | 0-29 | Critical - broken ciphers, TLS 1.0/1.1 primary, very weak RSA. |
Per-Port Scoring (0-100 points)
Design intent: An A grade is unreachable without actual PQC key exchange. TLS 1.3 + ML-KEM-768 + any reasonable cert (RSA-2048+) guarantees a minimum A. A+ requires CNSA 2.0 key sizes (ML-KEM-1024).
| Component | Max Points | Key Rules |
|---|---|---|
| Protocol Level | 20 | TLS 1.3 = 20; TLS 1.2 = 10; TLS 1.1 = 3; TLS 1.0 = 1. Deduct -3 if TLS 1.1 in supported list; -5 if TLS 1.0. |
| Primary Key Exchange | 35 | ML-KEM-1024 hybrid = 35; ML-KEM-768 hybrid = 32; ML-KEM-1024 only = 33; ML-KEM-768 only = 30; ML-KEM-512 = 25; X25519/X448 = 20; secp384r1/P-521 = 18; secp256r1 = 17; RSA (no ephemeral) = 5. |
| Certificate Public Key | 20 | ML-DSA/SLH-DSA/FALCON = 20; EC P-384+/P-521/Ed448 = 17; EC P-256/Ed25519 = 16; RSA-4096 = 15; RSA-3072 = 13; RSA-2048 = 12; RSA-1024 = 3. |
| Signature Hash | 10 | SHA-512/SHA-384 = 10; SHA-256 = 8; SHA-1 = 2; MD5 = 0; unknown = 5. |
| Cipher Suite Quality | 15 | Start 15. AES-128-GCM = -1; CBC mode = -4; broken (RC4/DES/3DES/NULL) = -8; any insecure in supported list = -3; weak cipher = -1. Floor at 0. |
Certificate Validity Deductions
Applied post-sum; can push score below a grade threshold. Floor at 0.
| Condition | Deduction |
|---|---|
| Certificate is expired | -10 pts |
| Certificate is self-signed | -5 pts |
| Certificate validity > 5 years | -8 pts |
| Certificate validity > 3 years | -5 pts |
Application & System Grades
Application Grade
- Base = worst-port score (weakest link)
- OS deductions: -5 if no TLS 1.3 support; -5 if no PQC crypto stack; -3 if OS is end-of-life
- Deductions are additive - apps with their own TLS stack (Nginx, JVM) may still earn A/A+
System Grade
- Weighted average of app scores (weighted by port count)
- OS bonus: 0-5 pts from OperatingSystemScore
- Capped at 100; uses same A-F thresholds
Score Ceiling Examples
| Configuration | Max Score | Grade |
|---|---|---|
| Classical only - TLS 1.3 + X25519 + Ed25519 + SHA-384 + AES-256 | 83 | B |
| TLS 1.3 + ML-KEM-768 only + RSA-2048 + SHA-256 + AES-256 | 85 | A |
| TLS 1.3 + ML-KEM-768 hybrid + ML-DSA cert + perfect | 97 | A |
| TLS 1.3 + ML-KEM-1024 only + ML-DSA cert + perfect | 98 | A+ |
| TLS 1.3 + ML-KEM-1024 hybrid + ML-DSA cert + perfect | 100 | A+ |