Just as an implementation note, one way to maintain compatibility with older devices while allowing modern ones to use better levels of security is to use haproxy on the front end. This can handle TLS/SSL itself or hand over to the correct SSL backend depending on the connecting device.