For starters, please refer to https://wiki.mozilla.org/Security/Server_Side_TLS. For SSH, I lack clear, good advice. I've tended to disable weaker ciphersuites using Mozilla's TLS configuration advice as a guide, and I've also tended to use larger key sizes than the defaults. As questionable as NIST's guidelines have been lately, I tend to follow the high end of their recommended key sizes, so 4096-byte public keys, etc.