HOWTO: A+ with all 100%'s on SSL Labs test using apache2.4 (READ WARNINGS)

I can confirm that you don’t need key pinning to get 4x100% in SSLLabs (and frankly, it scares me).

My Raspberry Pi I use for testing https://penfold.fr got full scores without needing it. I only got an “A” rather than A+ at Scottt’s https://securityheaders.io due to this omission though.

Note that renewing my certificates worked fine but for some reason it recently reverted to 2048-bit RSA (which shaves 5 or 10% off the key exchange score), so now I guess I’ll have to specify letsencrypt-auto --rsa-key-size 4096 every time.

I can thoroughly recommend Ivan Ristic’s “Bulletproof SSL and TLS” book (he of SSL Labs fame) for a great guide on how all this works.