Troubleshooting

    Why did my SSL grade drop?

    SSL grade drops when a cipher, protocol, or certificate chain changes — here is how to identify the exact cause and fix it.

    Part of SSL certificate monitoring — the full answer, the facts and the alternatives in one place.

    Updated 2026-07-09
    2 min read
    ssl
    tls
    grade

    Quick answer#

    An SSL grade drop almost always means one of four things changed: a weak cipher was re-enabled, TLS 1.0/1.1 came back, the chain is missing an intermediate, or the certificate is near expiry. The Site → Security → SSL panel names the exact rule that failed.

    What triggers a drop#

  1. Weak ciphers re-enabled (3DES, RC4, CBC without AEAD)
  2. TLS 1.0 or 1.1 accepted
  3. Missing intermediate certificate in the chain
  4. Certificate expiring in under 30 days
  5. Hostname mismatch or self-signed cert on a subdomain

    6. Where to find it in Lemwatch#

    Site → Security → SSL details. The grade card shows the exact failed check with a plain-English reason.

    How to fix it#

  6. Open Site → Security → SSL details and note the failing rule.
  7. If cipher-related, edit your web server config (nginx ssl_ciphers, Apache SSLCipherSuite) to remove weak suites.
  8. If chain-related, re-install the certificate with the full intermediate bundle.
  9. If expiry-related, renew via Let's Encrypt / your CA (see SSL renewals).
  10. Click Recheck now — the grade updates within 2 minutes.

    11. FAQ#

    Does Cloudflare "Full (strict)" mode affect my grade?#

    Yes — check both Cloudflare's edge cert and your origin cert. Both are graded.

    Why did the grade drop without me changing anything?#

    SSL grading standards tighten annually. Old configs stop passing new rules.

    Related#

  11. SSL monitoring
  12. SSL certificate renewals
  13. Cloudflare blocking Lemwatch
    14. Was this article helpful?

    Previous

    Fixing 5xx errors caused by your firewall

    Next

    Bypassing bot protection for Lemwatch checks

    Related Articles

    SSL Certificate Monitoring

    Track SSL certificate validity, expiry dates, and chain issues. Get warned 30, 14, and 7 days before certificates expire.

    SSL & Domain Renewals

    Track SSL certificate and domain expiry dates to avoid service interruptions.

    Cloudflare is blocking Lemwatch checks

    Fix Cloudflare "Challenge", "Managed Challenge", or 1020 errors that make Lemwatch see your site as down.

    My Site Shows as Down But It's Working

    Why LemWatch might report downtime when your site is actually accessible.

    Back to Help Center