I want to set up a very secure-from-MITM-attacks server. I have these algorithms enabled in my nginx and I'm getting an A+ on ssllabs.com but it's complaining that my cipher strength isn't 100% and that my key exchange isn't either. Even if reordering these won't improve it, I still would like to sort them by security level.
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 ECDH secp256r1 FS 128 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 ECDH secp256r1 FS 256 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 DH 4096 bits FS 128 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 DH 4096 bits FS 256 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 ECDH secp256r1 FS 128 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA ECDH secp256r1 FS 128 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 ECDH secp256r1 FS 256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA ECDH secp256r1 FS 256 TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 DH 4096 bits FS 128 TLS_DHE_RSA_WITH_AES_128_CBC_SHA DH 4096 bits FS 128 TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 DH 4096 bits FS 256 TLS_DHE_RSA_WITH_AES_256_CBC_SHA DH 4096 bits FS 256
If there is another change I need to make to fix my nginx setup I'm interested in learning that as well.