I'm the OP and I'm happy to take recommendations on making this configuration better. In particular, I'm not sure what ciphers to disable to achieve FIPS compliance.