You and tptacek are both right, so how about the following to combine your positions: * Grade 'A' requires AES-GCM and ChaCha20Poly1305 * Allow CBC for 'A' if

You and tptacek are both right, so how about the following to combine your positions: * Grade 'A' requires AES-GCM and ChaCha20Poly1305 * Allow CBC for 'A' iff it's a last resort option * Use nginx equivalent of "ssl_prefer_server_ciphers on;" CBC would then only be used by clients that don't support AE ciphersuites.