Well, you have to tune protocols, ciphers and some other settings to suit your taste. You are also mixing protocols and cipher suites, which probably isn't good.
Here's the basic SSL/TLS configuration for www.cryptopp.com, which is an open source project I help with. It runs on a CentOS 7 VM, and scores a "A" with the Qualsys tests. None of us are Apache experts, so take the configuration at face value. We do enough so users don't experience problems, but not much more.
Usually you want something like "TLS 1.0 and above" (
SSLProtocol -all +TLSv1 +TLSv1.1 +TLSv1.2) and "Modern cipher suites" (
SSLCipherSuite HIGH:!aNULL:!kRSA:!MD5:!RC4). The
!kRSA means "no RSA key transport", which effectively leaves Diffie-Hellman and forward secrecy.
The configuration also sets the STS header (
# cat /etc/httpd/conf.d/ssl.conf | grep -v '#'
Listen 443 https
SSLRandomSeed startup file:/dev/urandom 256
SSLRandomSeed connect builtin
ServerAlias *.cryptopp.com cryptopp.com
SSLProtocol -all +TLSv1 +TLSv1.1 +TLSv1.2
Header set Strict-Transport-Security "max-age=15552001; includeSubdomains;"
I'm also guessing you are not using OpenSSL 1.1.0. Rather, you are probably using an older FIPS version. Here's from the same CetOS 7 VM:
$ openssl version
OpenSSL 1.0.1e-fips 11 Feb 2013
Maintainers backport patches, so about all you know is (1) you started somewhere around 1.0.1e, (2) you don't really know what you have at the moment, and (3) you have a Frekenstein-like contraption that's been pieced together.