The SSLLabs.com test will provide ratings based on the Keys strength as noted below. I will provide a cipher suite that supports Perfect Forward Secrecy (FS) for Elliptical Curves and RSA in the best possible order. Currently they include legacy ones that are considered safe for your consideration based on your need and environment.

0 bits (no encryption) 0%
< 128 bits (e.g., 40, 56) 20%
< 256 bits (e.g., 128, 168) 80% <---we will score a 90-95%     Removing 128 bit ciphers would drop support for too many people!
>= 256 bits (e.g., 256) 100%

• Anything under 128 is not recommended
• Most Certificate Authorities (CA) support 256 bit encryption - few even support issuing 384 bit to end clients (if required)
• If being created for a US Top Secret environment:
• Use 256 bit keys
• Only use TLSv1.2 and TLSV1.3 Protocols
• Elliptic Curve Digital Signature Algorithm (ECDSA) & Elliptic Curve Diffie-Hellman (ECDH) Key Exchange use Curve P-384
• Secure Hash Algorithm (SHA) 384
• Minimum 3072-bit modulus

What does all of this mean in the end and what are we going to end up with?

Using RSA or ECC with Diffie-Hellman Parameters makes a huge difference in our security with very little cost!

ECC can use smaller key sizes while offering comparable cryptographic strength.