That grade is actually mostly about your TLS configuration (available cipher suites, etc.), and not about the certificate. Aside from some major no-goes (like S

That grade is actually mostly about your TLS configuration (available cipher suites, etc.), and not about the certificate. Aside from some major no-goes (like SHA-1 certificates), TLS security is about server configuration; certificates are relatively straightforward in that respect. It's true that they embrace a lot of best practices, like short certificate lifetimes, automation, logging all certificates to CT log servers (which StartSSL started doing quite recently as well), etc. The client also helps with securing your TLS configuration, among other things.