mozilla / tls-observatory

An observatory for TLS configurations, X509 certificates, and more.
Mozilla Public License 2.0
535 stars 88 forks source link

TLS Observetory's grade system in the Scan Summary is confusing #374

Open JohnLBevan opened 5 years ago

JohnLBevan commented 5 years ago

When using the HTTP observatory, a grade system is used for scoring; i.e. F is bad, E is better, A+ is best. This is a scoring system most are familiar / comfortable with.

However, when using the TLS observatory, initially you score F, so make some improvements only to find your score's now I; which is worse, surely...?

In this case it seems that F means Fail (defined as Compatibility Level: Insecure) whilst I means Intermediate... Though I've not found this documented anywhere. Amending the grading system to be consistent with the HTTP Observatory's approach, or providing a link to documentation explaining this grading / showing that I is better than F would remove some confusion.