There's some good resources out there, the problem here is that most people simply don't care or don't think it's part of their job to fix these things.

https://mozilla.github.io/server-side-tls/ssl-config-generat...

https://cipherli.st/