Re: Point 1<p>You really only need two ciphers to get to most browsers&#x2F;clients and good security and speed (replace RSA with ECDSA if needed):<p>TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256<p>TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA<p>Example: <a href="https:&#x2F;&#x2F;www.ssllabs.com&#x2F;ssltest&#x2F;analyze.html?d=theandrewbailey.com" rel="nofollow">https:&#x2F;&#x2F;www.ssllabs.com&#x2F;ssltest&#x2F;analyze.html?d=theandrewbail...</a><p>It baffles me that Mozilla recommends 20 ciphers for their highest security level. I think high security should be more exclusive than that, and with forward secrecy only.<p>Point 5:<p>How I imported Let&#x27;s Encrypt&#x27;s certificates into a Java keystore:<p><pre><code>    openssl pkcs12 -export -name yourdomain -in fullchain.pem -inkey privkey.pem -out pubchainpriv.p12
    keytool -importkeystore -srcstoretype pkcs12 -srckeystore pubchainpriv.p12 -alias yourdomain -destkeystore &#x2F;path&#x2F;to&#x2F;keystore.jks</code></pre>