Thanks to letsencrypt, I finally got around to enabling SSL on this site.
I cribbed some settings from Remy van Elst and used his checker to make sure all is configured correctly.
I'm also using his monitoring service until such time as I automate the renewal process.