It may just be that they're waiting on more consensus from browser/OS makers and will take a stronger look at this next year as Chrome's (and perhaps Firefox/Sa

It may just be that they're waiting on more consensus from browser/OS makers and will take a stronger look at this next year as Chrome's (and perhaps Firefox/Safari/IE by that point) general SCT deadline approaches. That said, honest question: are certificate authentication questions really within the strict scope of their focus on SSL? The items they grade is pretty bread-and-butter technical compliance and best practices stuff, within the direct control of a single party (the server owner) and independent of any others. It's pretty unambiguous despite any difficult subject choices that may arise from old infrastructure/client issues. Further, there's also the fact that in all this SSL Labs has grown to fill an important unfilled niche in evaluation. By their nature though CA evaluation and choices are a lot mushier and involve more politics and human factors (witness the recent debates surrounding certificate transparency and how it interacts with internal service usage, vis-a-vis redaction etc). And fundamentally, there are also a lot of powerful, interested actors deeply involved already. Authentication is just a separate domain from the crypto itself, and involves a different set of hairy issues.