In short: Yes. In ProVide’s own tests, a ProVide HTTPS endpoint earned an A+ on the Qualys SSL Labs server test with a score of 100 in all four categories. That result needs a 4096-bit RSA or P-384 ECDSA certificate, TLS 1.2 and TLS 1.3, the cipher settings in ProVide’s Achieving high security guide, and an HSTS header. Brute-force protection and detailed audit logging are built in.
Applies to: Medi / Maxi / Mega | Latest ProVide version for the full score [17.3.2.58] | Windows, Linux (Docker)
Last reviewed: October 2026
What does an A+ on Qualys SSL Labs mean? #
Qualys SSL Labs is a free online test that grades the TLS configuration of a public web server, from A+ down to F. TLS (Transport Layer Security) is the encryption behind HTTPS. An A+ requires a strong configuration with no warnings, support for TLS 1.3, and HTTP Strict Transport Security (HSTS) with a max-age of at least six months. Without TLS 1.3 or a valid HSTS header, the grade is capped at A-.
The grade belongs to the specific HTTPS endpoint you test, not to the software. Two ProVide installations can get different results depending on their certificate and settings. A server with a self-signed certificate gets a T (not trusted) instead of a normal grade.
An A+ is also not the same as a perfect score. SSL Labs scores the certificate, protocol support, key exchange and cipher strength separately. All four depend on the combination of certificate, protocols, key exchange settings and ciphers you enable.
Does the SSL Labs grade cover FTPS and SFTP? #
No. The grade covers the HTTPS endpoint you test, and it is not a rating of ProVide’s FTPS or SFTP services.
FTPS also uses TLS, but in ProVide it has its own TLS versions and cipher suites, configured separately from HTTPS. SSL Labs does not test the FTPS service.
SFTP runs over SSH, a separate protocol with its own key exchange, cipher and MAC (message authentication code) algorithms. ProVide has separate settings for SSH key exchange and MAC algorithms, so you secure SFTP on its own too.
The grade also says nothing about passwords, user permissions or how files are stored. Qualys points this out itself: TLS protects the connection, not the rest of the system.
Which TLS protections does ProVide include? #
ProVide has separate TLS settings for HTTPS and for FTPS. The protections include:
- TLS 1.2 and TLS 1.3. Older protocols (SSL 2.0, SSL 3.0, TLS 1.0 and TLS 1.1) are disabled by default ,and you can turn each version on or off.
- Support for AEAD cipher suites with forward secrecy. AEAD (authenticated encryption with associated data) encrypts and integrity-checks data in one step. Forward secrecy means a stolen server key cannot decrypt traffic recorded earlier. You choose which cipher suites to enable, so you can leave out suites without forward secrecy, such as those with plain RSA key exchange.
- Configurable elliptic curves for key exchange, such as X25519 and SECP384R1 (also called P-384), in the order you choose.
- Support for HSTS, which tells browsers to connect to the server only over HTTPS. HSTS is not sent by default. You enable it by adding a Strict-Transport-Security header, as described in ProVide’s Custom HTTP Headers guide.
- Full certificate chain loading, including intermediate certificates.
- Secure renegotiation, with client-initiated renegotiation disabled.
These settings matter for the grade. SSL Labs caps a server at B if it supports TLS 1.0 or TLS 1.1, or if it lacks forward secrecy or AEAD ciphers.
What do you need for 100 in every SSL Labs category? #
In our own tests, the A+ and 100 in all four categories came from this combination:
- The latest version of ProVide.
- A 4096-bit RSA or P-384 ECDSA certificate from a publicly trusted certificate authority (CA).
- Both TLS 1.2 and TLS 1.3 enabled. With TLS 1.3 alone, the same test gave an A instead of an A+.
- The elliptic curve and cipher settings for your certificate type, as listed in the Achieving high security guide.
- An HSTS header with a max-age of at least six months, which the A+ grade requires.
When the settings are in place, run the Qualys SSL Labs server test against your server’s public hostname to check the result.
What other security features does ProVide have? #
- Anti-hammering can block an IP address after repeated connection or login attempts, which helps protect against brute-force attacks on passwords.
- Windows account impersonation (optional) lets sessions for users who sign in with a Windows account run with that account’s own permissions.
- Extensive logging gives you an audit trail for traceability.
- FTPS and SFTP are both supported. FTPS works in both explicit mode (AUTH TLS on the same port) and implicit mode (a dedicated SSL/TLS port), and SFTP supports protocol versions 3 to 6, with a choice of encryption, MAC and key exchange algorithms.
- Your choice of certificate: self-signed or issued by a CA. Only a certificate from a publicly trusted CA can get a normal SSL Labs grade.
Related #
For the exact settings.ini values for RSA and ECDSA certificates, see Achieving high security in ProVide.
