SSL grade drops when a cipher, protocol, or certificate chain changes — here is how to identify the exact cause and fix it.
Quick answer
An SSL grade drop almost always means one of four things changed: a weak cipher was re-enabled, TLS 1.0/1.1 came back, the chain is missing an intermediate, or the certificate is near expiry. The Site → Security → SSL panel names the exact rule that failed.
What triggers a drop
Weak ciphers re-enabled (3DES, RC4, CBC without AEAD)
TLS 1.0 or 1.1 accepted
Missing intermediate certificate in the chain
Certificate expiring in under 30 days
Hostname mismatch or self-signed cert on a subdomain
Where to find it in Lemwatch
Site → Security → SSL details. The grade card shows the exact failed check with a plain-English reason.
How to fix it
Open Site → Security → SSL details and note the failing rule.
If cipher-related, edit your web server config (nginx ssl_ciphers, Apache SSLCipherSuite) to remove weak suites.
If chain-related, re-install the certificate with the full intermediate bundle.
If expiry-related, renew via Let's Encrypt / your CA (see SSL renewals).
Click Recheck now — the grade updates within 2 minutes.
FAQ
Does Cloudflare "Full (strict)" mode affect my grade?
Yes — check both Cloudflare's edge cert and your origin cert. Both are graded.
Why did the grade drop without me changing anything?
SSL grading standards tighten annually. Old configs stop passing new rules.