use strong ciphers, pfs, modern tls -> A rating in ssllabs.com ssl test and reasonable compatibility