---
title: "Why did my SSL grade drop? — Lemwatch Help"
description: "SSL grade drops when a cipher, protocol, or certificate chain changes — here is how to identify the exact cause and fix it."
canonical: "https://lemwatch.com/help/why-ssl-grade-dropped"
source: "https://lemwatch.com"
---

# Why did my SSL grade drop?

> SSL grade drops when a cipher, protocol, or certificate chain changes — here is how to identify the exact cause and fix it.

## Quick answer

 An SSL grade drop almost always means one of four things changed: a weak cipher was re-enabled, TLS 1.0/1.1 came back, the chain is missing an intermediate, or the certificate is near expiry. The Site → Security → SSL panel names the exact rule that failed.

## What triggers a drop

- Weak ciphers re-enabled (3DES, RC4, CBC without AEAD)

- TLS 1.0 or 1.1 accepted

- Missing intermediate certificate in the chain

- Certificate expiring in under 30 days

- Hostname mismatch or self-signed cert on a subdomain

## Where to find it in Lemwatch

 **Site → Security → SSL details**. The grade card shows the exact failed check with a plain-English reason.

## How to fix it

- Open Site → Security → SSL details and note the failing rule.

- If cipher-related, edit your web server config (nginx ssl_ciphers , Apache SSLCipherSuite ) to remove weak suites.

- If chain-related, re-install the certificate with the full intermediate bundle.

- If expiry-related, renew via Let's Encrypt / your CA (see SSL renewals ).

- Click Recheck now — the grade updates within 2 minutes.

## FAQ

### Does Cloudflare "Full (strict)" mode affect my grade?

 Yes — check both Cloudflare's edge cert and your origin cert. Both are graded.

### Why did the grade drop without me changing anything?

 SSL grading standards tighten annually. Old configs stop passing new rules.

## Related

- SSL monitoring

- SSL certificate renewals

- Cloudflare blocking Lemwatch


## Related

- [Help centre](https://lemwatch.com/help)
- [SSL Certificate Monitoring](https://lemwatch.com/help/ssl-monitoring)
- [SSL & Domain Renewals](https://lemwatch.com/help/renewals-ssl-management)
- [Cloudflare is blocking Lemwatch checks](https://lemwatch.com/help/cloudflare-blocking-lemwatch)
- [Bypassing bot protection for Lemwatch checks](https://lemwatch.com/help/bypassing-bot-protection)
- [How to use the free SSL certificate checker](https://lemwatch.com/help/using-the-free-ssl-checker)
- [Lemwatch pricing](https://lemwatch.com/pricing)
- [Embeddable Monitoring Widgets](https://lemwatch.com/help/widget-embeds)