Thanks to letsencrypt, I finally got around to enabling SSL on this site.

I cribbed some settings from Remy van Elst and used his checker to make sure all is configured correctly.

I'm also using his monitoring service until such time as I automate the renewal process.