Transport Layer Security

Here’s a quick checklist of best practices as of this writing. It is by no means complete, but should get you well on your way.

Stop using

aNULL non-authenticated DH exchanges (MITM attack)
eNULL (cleartext)
SSL2 (DROWN attack)
SSL3 (POODLE attack)
RC4 (see: RFC 7465 and https://blog.cloudflare.com/killing-rc4-the-long-goodbye/)
MD5 (collisions are trivial)
EXPORT ciphers (deliberately weakened)
DES (deprecated Data Encryption Standard)
3DES (Sweet 32 Attack)
Weak Diffie-Hellman parameters (Logjam attack)
SHA1 (SHAttered attack)
SSL Compression (CRIME attack)