That's an excellent reference with good explanations. I'll add it to the list to get away from the strong Ivan bias :-). The reason why I had A- only is that my openssl (Debian) doesn't seem provide all the ciphers required.
Sadly, this means IE doesn't get forward secrecy, because it can't do do DHE with RSA keys, only DSS.