Test the quality of your HTTPS configuration

Last update: 2016-09-26

Given the vulnerabilities discovered in some SSL libraries over the years, test your HTTPS server configuration before putting an application into production. Fortunately, Qualys Inc. provides an excellent testing tool.

How do I test my digital certificate configuration? ​

Visit the Qualys page and enter the domain you want to test. You do not need to enter the full URL or the https:// prefix—just the domain.

If your domain resolves to more than one IP address, the test checks consistency between the addresses and reports a grade for each server (which will probably be the same). The final report contains details of each test. Testing each server takes about two minutes on average.

SSL test for phcco.com

Grades range from "F" (worst) to "A+" (best).

Qualys SSL found problems. What should I do? ​

Do not panic. Follow the instructions on the test page and search for a solution to each required change. In some cases, disabling insecure protocols is enough to improve your score.

Is an "A" enough? ​

For most situations, yes. If your site uses both HTTP and HTTPS, you will not receive a grade higher than this.

How can I get an "A+"? ​

To get an "A+", you also need to enable HSTS, which tells browsers never to try the HTTP version of the site. The drawback of HTTP Strict Transport Security is that the site can then only be accessed over HTTPS; if you later remove the digital certificate, the site may remain inaccessible for a long time.

The relevant header is Strict-Transport-Security: max-age=expireTime. It can be added in several ways. In PHP, you could add this at the beginning of a page:

php
<?php
	header("Strict-Transport-Security: max-age=15552000; preload");

This header tells the browser to remember that the site is HTTPS-only for 15,552,000 seconds (180 days). If you stop using HTTPS, the site may remain inaccessible for up to 180 days. This is a commonly used and recommended minimum.

It prevents a site visitor from sending cookies over an insecure connection by opening the HTTP version of a page—even briefly or only once. Financial institutions commonly use this header; other services often avoid it because downgrading the connection later can be difficult.

References ​