- Use TLS 1.3 first, only when client doesn’t support, downgrade to TLS 1.2. Use AEAD (Encrypt-then-MAC) only, including TLS 1.2.
- Use 256-bit encryption for https://126.96.36.199 and https://188.8.131.52 only, please don’t use 128-bit encryption. Consider use Chacha20_Poly1305, it seems consume less power and faster in mobile phone.
- Use safe curves only. If client support, use Ed448-Goldilocks or named Curve448, if not, use Curve25519, about safe curves, see also RFC 7748 https://tools.ietf.org/html/rfc7748/ and https://safecurves.cr.yp.to/
- Use 4096-bit RSA. ECDSA uses awful NIST Prime Curves, EdDSA has fault attack.