TLS 1.3 Cipher Suites: 1 Required, 2 Recommended [2026]
Enable three suites and stop there. Put TLS_AES_128_GCM_SHA256 and TLS_AES_256_GCM_SHA384 in your list because every serious TLS stack supports them, and add TLS_CHACHA20_POLY1305_SHA256 so that clients without AES acceleration have a fast path. Skip TLS_AES_128_CCM_SHA256 unless a constrained device or a protocol profile forces…