Well I’m really satisfied. I dumped my stupid self-signed CA and have a 100/100/100/90 A+ on SSLabs. All for free!
I honestly don’t mind if its SHA256 or SHA512. This server is low traffic, isn’t used publicly, and is really overpowered for what it does, so performance won’t be an issue. The only thing that I want now is for an OpenSSL release on Debian that includes CHACHA20 and POLY1305 (I don’t want to mess with any patches).