A few notes on configuring a web-server with secure TLS protocol versions and Ciphers. NGINX is used in the examples herein, but the protocols, ciphers and headers should be universal.
There's some good advice from Mozilla here  , and @rootsecdev wrote a Medium Post on configuring IIS on Windows Server 2019 .
TLSOnly TLSv1.2 and TLSv1.3 are considered secure, so start with configuring these as the only supported protocols.
Change the config file to:
ssl_protocols TLSv1.2 TLSv1.3;
If only modern clients are used you can get away with TLSv1.3 only. Windows Server builds newer than 1903 supports TLSv1.3 too, however enabling this is not covered in . It can be found with some Google-fu, though.
CiphersOnly protocols with Perfect Forward Secrecy (PFS) should be used, and CBC has some issues (see  for more information). That leaves us with the following ciphers configured in the NGINX conf-file:
ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384;For compatibility with older stuff use the intermediate configuration use Mozilla's configurator . Please note that the above ciphers will effectively remove access for Android 5 and 6, Firefox <= 47, Safari 6-8, and likely a few other legacy platforms.
HSTS HeaderStrict Transport Security will ensure that everything is served over HTTPS, configure this as shown below for an age of a year:
add_header Strict-Transport-Security "max-age=31536000" always;
- Use TLSv1.3 and nothing else if you can get away with it.
- Enforce HTTPS using strict transport security.
- If TLSv1.2 is needed limit the ciphers used as discussed above.
For all of the settings above, Mozilla has a pretty good configurator discussed here  and found here 
If you're running Citrix ADC (The artist formerly known as Netscaler), there's a recent (Jan 2020) post worth reading .
 Padding oracles and the decline of CBC-mode cipher suites: https://blog.cloudflare.com/padding-oracles-and-the-decline-of-cbc-mode-ciphersuites/
 Security/Server Side TLS: https://wiki.mozilla.org/Security/Server_Side_TLS
 Mozilla's SSL Config generator: https://ssl-config.mozilla.org/
 Configuring secure cipher suites in Windows Server 2019 IIS: https://medium.com/@rootsecdev/configuring-secure-cipher-suites-in-windows-server-2019-iis-7d1ff1ffe5ea
 Citrix Networking SSL / TLS Best Practices: https://docs.citrix.com/en-us/tech-zone/build/tech-papers/networking-tls-best-practices.html