You could look at the source for my titus TLS proxy server[1]. It gets an A out of the box, and an A+ if the application sends the HSTS header.

[1] In particular, these two blocks of code: https://github.com/AGWA/titus/blob/43ecf6889d4c5a61f58de5f8a... https://github.com/AGWA/titus/blob/43ecf6889d4c5a61f58de5f8a...