I am enjoying an environment configured to only allow TLSv1.2 and deny everything else. It may not be a realistic option for everyone, but for anything new built in 2015 and later is the only sensible choice.