Which means you shouldn't trust that A+ single metric without actually looking at the browser list or testing it yourself. I just opened your site on Debian uns

Which means you shouldn't trust that A+ single metric without actually looking at the browser list or testing it yourself. I just opened your site on Debian unstable with latest Iceweasel/Firefox 24.5.0, and I get connected via RC4. Arguably thats also NSS's fault for implementing TLS1.2 so late, but still... My site only gets an "A" rating, but Firefox actually connects using ECDHE-RSA-AES256-SHA. I use this cipherlist HIGH:!SSLv2:!aNULL:!3DES Which one is more secure?