Re:OpenSSL 3.0 released; relicensed to Apache-2.0
by chasil on Monday September 20, 2021 @06:23PM
(#28599822)
This has been useful advice for many years, although restricting to AEAD is best when possible.
https://hynek.me/articles/hardening-your-web-servers-ssl-cip...
For custom protocols, libsodium would be a popular modern approach. If you need compatibility with TLS, try locking down TLS to only version 1.3, or if you can't do that, lock it down to only TLS 1.2 with tls_ecdhe_rsa_with_aes_128_gcm_sha256.