I really like Mozilla's recommendations, which are detailed, explicit, and well-justified: https://wiki.mozilla.org/Security/Server_Side_TLS#Recommende...