On Aug 8, 2019, at 4:33 AM, Steven Smith <steve.t.smith@gmail.com> wrote:

This port is completely independent of Server.app, and uses an nginx reverse proxy for modern crypto and to isolate the backend server. I have it deployed and it’s working well.

What 'modern crypto' are you referring to? Twisted (upon which CalendarServer is based) ought to be able to get an A+ on SSLLabs and use all the most modern ciphersuites (including TLS 1.3). I'm not up on CalendarServer's configuration these days, but it should be possible to adjust it to be as fancy and modern as it needs to be...