Use testssl.sh instead of the SSL Labs web check

SSL Labs is good and it only works on hosts the internet can reach. Which rules out staging, anything internal, and CI.

./testssl.sh --severity HIGH --quiet https://example.com

Same class of findings, runs against internal hosts, exits non-zero so you can gate a pipeline on it. --jsonfile if you want to diff results over time.

Going from a D to an A+ is mostly three things: drop everything below TLS 1.2, fix the chain, and turn on HSTS. The rest is fine tuning.