4 ms·

You cannot get an A+ on SSL Labs without 4096 bit cert. It is just a vanity thing IMHO.

• agwa 11y ago
  Not true. My sites have an A+ on SSL Labs with a 2048-bit RSA cert. Edit: you may be thinking of one of the numeric scores, which probably requires 4096-bit RSA to max out. But you'd be best served ignoring the numeric scores and just focusing on the letter grade. You really do not need a 4096-bit end-entity RSA key to have "A+"-level security.
• Panino 11y ago
  To expand on agwa's point, I recently received an A+ with a 3072-bit cert. The site config was TLS 1.2-only, with only 256-bit FS ciphers, and HSTS. But I re-enabled TLS 1/1.1 for better browser/crawler support, which dropped the grade down to A.
• toast0 11y ago
  You need HTTP Strict Transport Security to get an A+, a 2048-bit cert is fine.
• ytch 11y ago
  From this document: https://www.ssllabs.com/downloads/SSL_Server_Rating_Guide.pdf https://www.ssllabs.com/downloads/SSL_Server_Rating_Guide.pd... Keys below 2048 bits (e.g., 1024) are now considered weak, and the grade capped at B. New grade A+ is introduced for servers with exceptional configurations. At the moment, this grade is awarded to servers with good configuration, no warnings, and HTTP Strict Transport Security support with a max-age of at least 6 months. Therefore A+ means key length>=2048 with other good config (TLS 1.2 and so on) and HSTS max-age>=6 month.
• deleted 11y ago
  [deleted]