TLS Cipher Suite Hardening Lab
TLS hardening fails on trade-offs, not knowledge. Anyone can disable SSL 3.0 and RC4 — the hard part is reaching an A+ while the one client that has to keep working still completes its handshake. Toggle the server's protocol versions and cipher suites, watch the grade move the way an SSL-Labs-style scanner would score it, and keep the required client alive. Hit the target grade without cutting it off, and you pass.
The real job. More noise, a tighter clock.
Goal
Target grade A+Harden a public HTTPS endpoint to A+: turn on TLS 1.3, drop SSL 3.0 / TLS 1.0 / 1.1, and remove RC4, 3DES, export, NULL and non-forward-secret suites — while a modern browser keeps connecting.
Required client: Required: company browser — needs TLS12 + one of ECDHE-RSA-AES128-GCM-SHA256, ECDHE-RSA-AES256-GCM-SHA384. Modern TLS 1.2 AEAD — easy to keep working.
Protocol versions (toggle what the server offers)
Cipher suites (enable strong, disable weak)
Live grade
Target A+ · required client connecting
Toggle protocols & suites, then grade the config.
● SSL 3.0 enabled — POODLE; caps the grade at F
● TLS 1.0 enabled — deprecated (BEAST); caps the grade at C
● TLS 1.1 enabled — deprecated; caps the grade at C
● TLS 1.3 not enabled — required for A+
How it's graded
SSLv3 / export / NULL / anon → instant F.
TLS 1.0/1.1 cap C · RC4 / 3DES cap B.
Non-forward-secret suite caps A.
TLS 1.3 + FS AEAD only → A+.
Live arena
4 activeadversary staging…
What this lab is
- A free, browser-based TLS lab: toggle protocol versions and cipher suites to harden a server to an SSL-Labs-style A+ without breaking a client that must keep working.
- The grade is computed live from your config — SSLv3, export, NULL and anonymous suites are an instant F; TLS 1.0/1.1 cap you at C; RC4 and 3DES cap you at B; a non-forward-secret suite caps you at A.
- Every scenario has a REQUIRED client (a browser, a legacy ERP terminal, an internal API) that must still complete its handshake — so you cannot just disable everything.
- Some clients are genuinely stuck on a weak suite, so the ceiling is B or C: the lesson is reaching the best grade that keeps the required flow alive, not chasing A+ at any cost.
- A handshake trace shows which clients connect and which downgrade probes (POODLE, RC4, anonymous-DH) a hardened server rightly refuses.
Frequently asked questions
What is the TLS Cipher Suite Hardening Lab?
A free, in-browser exercise where you decide which TLS protocol versions (SSL 3.0 through TLS 1.3) and which cipher suites a server offers. The lab grades the result the way SSL Labs would — penalising deprecated protocols, broken ciphers (RC4), weak block ciphers (3DES / SWEET32), export and NULL ciphers, anonymous key exchange, and the absence of forward secrecy — and checks that a required client can still complete a handshake.
How is the grade calculated?
Each enabled protocol and suite contributes a cap and a deduction. SSL 3.0, export-grade ciphers, NULL ciphers and anonymous suites cap the grade at F. TLS 1.0 and 1.1 cap it at C. RC4 and 3DES cap it at B. A non-forward-secret (static-RSA) suite caps it at A. To reach A+ you need TLS 1.3 enabled and only forward-secret AEAD suites offered, with every weak option removed. The final grade is the lower of the point score and the strictest cap any enabled option imposes.
Why is there a "required client"?
Because real hardening is a trade-off, not a checklist. Disabling TLS 1.0, RC4 and 3DES is easy until you remember the payment terminal or ERP integration that only speaks one of them. Each scenario pins a client that must keep connecting, so you have to find the strongest config that does not cut it off — sometimes that ceiling is B or C, and recognising that is the point.
Is this a real TLS scanner?
No. It is a teaching model of the grading logic SSL Labs popularised, with invented scenarios and clients. It runs entirely in your browser — no server, no account, no scan of any real host — so you can feel why protocol and cipher choices matter without touching production.