Going back to your request, it's impossible to do with server configuration alone. Many other aspects, including the design of the web application, play a significant role. The best we can do at this point is work on the body of knowledge, hoping others can find the time to invest.
The best I was able to do so far is build the SSL Labs test[1], write the SSL/TLS Deployment Best Practices guide[2], and start the SSL Research Wiki[3], where I intend to add other un-structured information over time (including example server configuration). I have also written a free OpenSSL Cookbook[4] (requires registration, and you can opt out of email afterwards).
Apologies if this post comes across as self-promoting, but this is what I spent a large amount of my time on. These are all genuinely useful and important resources.
[1] https://www.ssllabs.com/ssltest/
[2] https://www.ssllabs.com/projects/best-practices/
[3] https://github.com/ssllabs/research/wiki
[4] https://www.feistyduck.com/books/bulletproof-ssl-tls-and-pki...
That said -- perfect, good, enemies etc.
With all the talk of PFS lately I've been trying to configure Apache to do it, but either I'm dumber than I thought or there's no straightforward how-to online at the moment.
Instead of telling us the various crazy pitfalls and edge cases, just give dummies like me the best possible formula so we can configure things securely and then get on with our lives. The first step towards defeating eavesdropping is making the best possible SSL configuration a copy and paste affair instead of an acronym guessing game.
Edit: If total security isn't really possible right now as this post suggests, maybe a "best" configuration plus mailing list for when it's updated for varios major platforms (ie LTS) would be a good stopgap.