Getting B-Grade when I test the Lets-encyrpt certificate on https://www.ssllabs.com/ssltest/

[griffin]

Welcome to the Let's Encrypt Community, Girish

@happigirish

My cert is issued from Lets Encrypt, however on the SSL test report it states that Cloudflare has issued the certificate. I use the free version of Cloudflare CDN but dont remember configuring any SSL cert of cloud flare. Could you know why this is happening?

When you use Cloudflare, your visitors connect to Cloudflare's network (not your server), which serves Cloudflare's certificate to your visitors. Cloudflare then connects to your server, which serves a certificate to Cloudflare. If you use Cloudflare's Full SSL option, your server can serve Cloudflare a self-signed certificate (not recommended). If you use Cloudflare's Full (strict) SSL option, your server must serve Cloudflare either a Cloudflare Origin CA certificate or a certificate issued by a trusted CA (like Let's Encrypt). I highly recommend using a Cloudflare Origin CA certificate because it lasts much longer than a Let's Encrypt certificate and is very easy to manage through Cloudflare.

https://support.cloudflare.com/hc/en-us/articles/360024787372-End-to-end-HTTPS-with-Cloudflare-Part-1-conceptual-overview

https://support.cloudflare.com/hc/en-us/articles/115000479507

---

@happigirish

Looks like the SSL test was B rated because my server is supporting TLS version < 1.2
Even though the notice also states that server is also support TLS 1.2, 1.3, still it marked it as B grade. Do you know how to disable support for TLS VERSION < than1.2

For Cloudflare:

Use the following link and set to TLSv1.2 or TLSv1.3:
https://dash.cloudflare.com/redirect?zone=ssl-tls/edge-certificates

For your server:

Open /etc/letsencrypt/options-ssl-apache.conf with a text editor using root (for example: sudo nano /etc/letsencrypt/options-ssl-apache.conf). Modify according to the following then reload apache. You may have some of the directives cited below in multiple configuration files, so be sure to check.

SSLEngine on

# Comment out the existing line:
# SSLProtocol all -SSLv2 -SSLv3
# Add a new line:
SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1

#Comment out the existing line:
# SSLCipherSuite ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305 .....
# Add a new line:
SSLCipherSuite HIGH:!aNULL:!MD5:!3DES

SSLHonorCipherOrder on
SSLCompression off