I did split ioerror's duraconf nginx configs in 3 distinct configs with different ciphersuites lists, that specifically list desired ciphers in order, targetting :

- Very high security with low compatibility.

- PFS-only moderate security with high compatibility.

- PFS-centric moderate security with very high compatibility.

All of them give an A on Qualys SSL Labs test.

https://github.com/ouaibe/duraconf/tree/master/configs/nginx