Configuration issues identified by SSL Labs

The SSL Labs "SSL Server Test" service (https://www.ssllabs.com/ssltest/) identifies some aspects of the Racket web server's default HTTPS configuration that should be improved. Most significantly, it says, "This server does not support Forward Secrecy with the reference browsers. Grade capped to B."

I am still looking into the situation in more detail, but I've noticed at least two differences from the configuration generated by Certbot for Apache, which SSL Labs approves of:

1. While the Racket web server supports ECDHE, it doesn't seem to prefer more secure cypher suites to less secure ones.
2. The Racket web server's default configuration doesn't seem to enable DHE. It seems like this would force clients that support DHE but not ECDHE to fall back to RSA key exchange without forward secrecy.

I'm happy to do some implementation work here, but I haven't worked with these low-level portions before. In particular, I haven't figured out how to designate preferred cypher suites with the Racket openssl module.

Start with the Racket openssl module and the web server's default HTTPS configuration, then compare its cipher-suite preference and DHE behavior with the Certbot Apache configuration linked in the issue. Use SSL Labs' SSL Server Test to verify that the defaults prefer forward-secret suites and support the intended key exchanges.