[chasil]

This has been useful advice for many years, although restricting to AEAD is best when possible.

https://hynek.me/articles/hardening-your-web-servers-ssl-cip...