Secure ciphers must guarantee forward secrecy, and must mitigate all known critical attacks. As of 2018, using these ciphers allows you to obtain grade A on https://www.ssllabs.com. For A+, you must also enable HTTP Strict Transport Security (HSTS) by sending a suitable header field in replies.

Note that obsolete ciphers must be disabled to reliably prevent protocol downgrade attacks.

The Ciphers list is read from the setting ssl:secure_ciphers and can be controlled using set_setting/2 and other predicates from library(settings).

BEWARE: This list must be changed when attacks on these ciphers become known! Keep an eye on this setting and adapt it as necessary in the future.