for a safer selection of ciphersuites  you probably want to crib from the puppet openstackid vhost once the machine is using something to terminate tls that supports ecdhe then this should be edited to remove the rsa aesgcm rsa aes so that pfs only is guarenteed  sslciphersuite ecdh aesgcm dh aesgcm ecdh aes dh aes ecdh aes dh aes rsa aesgcm rsa aes  aes anull  enull  md dss  psk  srp sslhonorcipherorder on