What should I do to get an A+ from SSL Labs?

Short answer

Four conditions are required: a certificate obtained from a public CA with a complete chain; TLS 1.0/1.1 being disabled (Min. SSL Version = TLSv1.2); a strong Cipher Algorithms set that provides forward secrecy (General, Strict Secure or Strict Hardware Accelerated); and a long-duration HSTS header. The version, cipher and HSTS (SSL Labs requires at least 6 months; 1 year and includeSubDomains are recommended) are gathered in a TLS Security Profile and selected in the SSL Security module of the HTTP vService; if desired, HSTS can also be added with the Manage HTTP Security Headers action. Requests on port 80 are redirected to HTTPS. Because the Default Profile allows TLS 1.1 and does not add HSTS, it does not yield an A+.

Problem: The SSL Labs Grade Stays Below A+

The SSL Labs grade is given according to the trustworthiness of the certificate, the supported TLS versions, the cipher suites and the HSTS header. Allowing TLS 1.0/1.1, leaving the chain incomplete or offering suites without forward secrecy lowers the grade; A+, in turn, is given only with a long-duration HSTS header in addition to these. TR7's Default Profile allows TLS 1.1, uses the Only Secure Ones set, which also includes suites without forward secrecy, and does not add HSTS.

Condition	Where in TR7
Certificate from a trusted CA, with a complete chain	Certificates & PKI → SSL/TLS Certificates; the chain is checked on the Chain tab (How do I add the intermediate certificate chain?)
TLS 1.0 and 1.1 disabled	TLS Security Profile → Min. SSL Version = TLSv1.2
Strong ciphers with forward secrecy	TLS Security Profile → Cipher Algorithms = General, Strict Secure or Strict Hardware Accelerated
Long-duration HSTS	TLS Security Profile → HSTS (at least 6 months; 1 year recommended) or Manage HTTP Security Headers → Strict-Transport-Security (HSTS)
Redirect from HTTP to HTTPS	The HTTP → HTTPS frontend row for port 80 on the vService (How do I redirect HTTP to HTTPS?)

Solution: Three Methods

Method 1 gathers all the settings in a single profile; Method 2 sets up the same profile from the command line; Method 3 adds HSTS together with the other security headers from an action.

Your situation	Suitable method
From the interface, in a single profile	Method 1: A+ profile
From the command line	Method 2: WEB-CLI
Adding HSTS together with headers such as X-Frame-Options and X-Content-Type-Options	Method 3: Profile + Manage HTTP Security Headers

Method 1: A+ Profile Recommended

• How it works The version, cipher and HSTS settings are gathered in a single TLS Security Profile and selected on the HTTP vService.
• Where it is openedCertificates & PKI → TLS Security Profiles · vService → Details → Frontend Settings → SSL Security
• Requirement A certificate obtained from a public CA with a complete chain; an Encrypted (HTTPS) frontend on the HTTP vService
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the profile form

The Configuration Menu is opened with the TR7 logo at the bottom left; on the Certificates & PKI → TLS Security Profiles screen, Add is clicked (how to add); the Security Profile Name is entered.

2

Adım 2 Select the version and the cipher set

Min. SSL Version = TLSv1.2 is selected; Max. SSL Version is left off (TLS 1.3 is also accepted). Cipher Algorithms = Strict Secure (or General, Strict Hardware Accelerated) is selected; the TLS v1.3 Compatible set is not selected.

3

Adım 3 Turn on HSTS

In the Frontend-only Settings section, HSTS (Strict-Transport-Security header) is turned on; HSTS Duration (max-age) is set to 1 years (default 180 days) and Include Subdomains (includeSubDomains) is turned on. If an application to the preload list is to be made, Browser Preload List Flag (preload) is also turned on; this flag is saved only while the duration is at least 1 year and Include Subdomains is on (How do I add HSTS?).

4

Adım 4 Save the profile

Add at the bottom of the form is clicked.

5

Adım 5 Open the vService edit form

On the Load Balancer → Load Balancer vService List screen, the HTTP vService is selected and Edit is clicked.

6

Adım 6 Check the certificate and the redirect

It is checked that the certificate with a complete chain is selected in the Certificate field and that there is a Protocol = HTTP → HTTPS row for port 80.

7

Adım 7 Select the profile

In the Details panel, the SSL Security box under Frontend Settings is checked and the profile from step 4 is selected (profile selection in the vService).

8

Adım 8 Save

Save is clicked. In a cluster setup, with the default auto-sync, the change is also sent to the peer device; if Manual Sync Mode is on, it is sent to the peer device manually.

Verification

1GradeSSL Labs

The site is tested with SSL Labs; if it was tested before, the test is run again with Clear cache.

ExpectedA+ · TLS 1.0/1.1: No · HSTS: Yes · Chain issues: None

2HSTS headerClient side

Command: curl -skI https://www.example.com/ | grep -i strict-transport-security

ExpectedStrict-Transport-Security: max-age=31536000; includeSubDomains

Method 2: WEB-CLI

• How it works The same profile is created from the command line and assigned to the vService. Because in a profile created with WEB-CLI the fields are not filled with the Default Profile values as in the interface, the version, the cipher set and HSTS are written explicitly.
• Where it is opened TR7 WEB-CLI → lb ssl-security add · lb service update
• Requirement WEB-CLI access; the certificate and redirect conditions in Method 1
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Create the profile

The version and cipher fields and the HSTS fields are written in the same command; the HSTS subfields come after --hsts true:

lb ssl-security add name aplus --minSslVersion TLSv1.2 --cipherAlgorithm strictSecure --hsts true --hstsMaxAge.val 1 --hstsMaxAge.unit y --hstsIncludeSubdomains true

2

Adım 2 Assign the profile to the vService

--sslSecurity replaces the vService's profile with this profile:

lb service update id <vService> --sslSecurity aplus

Verification

1Record and gradeTR7 side · SSL Labs

The profile is displayed; then the SSL Labs test in Method 1 is performed.

Command: lb ssl-security show aplus

ExpectedminSslVersion TLSv1.2 · cipherAlgorithm strictSecure · hsts true · A+

Method 3: Profile + Manage HTTP Security Headers

• How it works The version and cipher rules come from the profile; HSTS, on the other hand, is added with the Strict-Transport-Security (HSTS) option of the Manage HTTP Security Headers action. The fixed value of the option, max-age=16000000; includeSubDomains; preload; (about 185 days), meets the long-duration HSTS condition. The same action can also add the following headers: Content-Security-Policy (default-src 'self'), X-Frame-Options (SAMEORIGIN), X-XSS-Protection (1; mode=block), X-Content-Type-Options (nosniff), Referrer-Policy (no-referrer-when-downgrade), Permission-Policy (interest-cohort=();) and the removal of the server fingerprint headers (Server, X-Powered-By, X-AspNet-Version, X-AspNetMvc-Version). Of these, only HSTS affects the SSL Labs grade.
• Where it is openedCertificates & PKI → TLS Security Profiles · Load Balancer → Actions → Action Type = Manage HTTP Security Headers
• Requirement The certificate and redirect conditions in Method 1
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Prepare the profile

With steps 1, 2 and 4 of Method 1, a profile with Min. SSL Version = TLSv1.2 and a strong cipher set is created; HSTS is left off in the profile.

2

Adım 2 Open the action form

On the Load Balancer → Actions screen, Add is clicked (how to add).

3

Adım 3 Select the headers

The Action Name is entered; Action Type = Manage HTTP Security Headers is selected. In the Response Headers list, Strict-Transport-Security (HSTS) and the other desired headers are checked. The action has no condition or execution timing field; it runs on every response, and HSTS is written only to HTTPS responses. If Strict-Transport-Security, Content-Security-Policy, X-Frame-Options and Referrer-Policy already exist in the response, the action's value replaces them; X-XSS-Protection and X-Content-Type-Options, on the other hand, are added next to the existing header.

4

Adım 4 Save the action

Add is clicked.

5

Adım 5 Open the vService edit form

On the Load Balancer → Load Balancer vService List screen, the HTTP vService is selected and Edit is clicked.

6

Adım 6 Select the profile and the action

In the Details panel, the SSL Security box under Frontend Settings is checked and the profile from step 1 is selected; the Actions box under Modules is checked and the action from step 4 is selected.

7

Adım 7 Save

Save is clicked.

Verification

1HeadersClient side

Command: curl -skI https://www.example.com/; then the SSL Labs test is performed.

ExpectedStrict-Transport-Security: max-age=16000000; includeSubDomains; preload; · A+

Common Mistakes

• Staying on the Default Profile. Because it allows TLS 1.1, offers suites without forward secrecy and does not add HSTS, an A+ is not obtained.
• Keeping the HSTS duration short. SSL Labs requires an HSTS of at least 6 months for A+; 1 year is selected in the profile. At least 1 year is also required for a preload application.
• Adding HSTS both in the profile and with an action. The action's value replaces the profile's value; HSTS is managed from a single place. The preload flag in the fixed value of Manage HTTP Security Headers does not meet the 1 year required for a preload application.
• Thinking that the other security headers will raise the SSL Labs grade. Headers such as X-Frame-Options and CSP increase application security; apart from HSTS, they do not affect the SSL Labs grade.
• Expecting HSTS on an L7 TCP vService. HSTS is an HTTP header; it is added only on an HTTP vService.
• Overlooking an incomplete chain. If the chain is incomplete, the grade drops; the certificate's Chain tab is checked (How do I tell if the certificate chain is incomplete?).

How it is done in the documentation

• TLS Security Profiles · HSTS (Strict-Transport-Security header)
• TLS Security Profiles · Cipher Algorithms
• Manage HTTP Security Headers · Response Headers
• WEB-CLI · lb ssl-security · The HSTS Fields

Related questions

• How do I disable TLS 1.0/1.1; is TLS 1.3 supported?
• How do I add HSTS?
• How do I tell if the certificate chain is incomplete?